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Highlights 

Highlights  of  GAO-09-591 ,  a  report  to 
congressional  committees 


DEFENSE  CONTRACTING  INTEGRITY 

Opportunities  Exist  to  Improve  DOD's  Oversight  of 
Contractor  Ethics  Programs 


Why  GAO  Did  This  Study 


What  GAO  Found 


Until  recently,  ethics  programs  and 
practices  of  defense  contractors 
were  self-policed.  Given  the 
significant  sums  spent  to  acquire 
goods  and  services,  the  Federal 
Acquisition  Regulation  (FAR)  was 
amended  twice  starting  in 
December  2007  to  first  mandate 
and  later  amplify  contractor  ethics 
program  rules.  Before  FAR  changes 
were  finalized  in  December  2008, 
Congress  required  GAO  to  report  in 
2009  on  the  ethics  programs  of 
major  defense  contractors.  This 
report  (1)  describes  the  extent  that 
contractors  had  ethics  programs 
before  the  finalization  of  the  FAR 
rules  that  included  practices 
consistent  with  standards  now 
required  by  the  FAR  and 
(2)  assesses  the  impact  the  new 
FAR  rules  have  on  Department  of 
Defense  (DOD)  oversight  of 
contractor  ethics  programs.  To  do 
this  work,  in  September  2008  GAO 
surveyed  all  57  contractors — those 
receiving  more  than  $500  million  in 
2006  DOD  contract  awards — and 
interviewed  DOD  contractor 
oversight  agency  officials  on  the 
impact  of  the  new  FAR  rules  on 
oversight. 


What  GAO  Recommends 


GAO  recommends  four  actions 
aimed  at  improving  oversight  of 
ethics  programs  during  contract 
administration  and  DOD  hotline 
poster  requirements  for 
contractors  to  ensure  that 
whistleblower  protections  are 
communicated.  DOD  concurs  with 
GAO’s  recommendations. 


View  GAO-09-591  or  key  components. 

For  more  information,  contact  John  Needham 
at  (202)  512-4841  or  needhamjk1@gao.gov. 
To  view  the  e-supplement  online,  click  GAO- 
09-646SP 


All  57  contractors  responded  to  GAO’s  survey,  and  55  reported  having  ethics 
programs  that  include  many  of  the  practices  consistent  with  standards  now 
required  for  compliance  with  the  FAR.  The  ethics  practices  information  GAO 
obtained  was  from  before  the  FAR  rules  were  finalized  and  thus  was  not 
designed  to  test  contractor  comphance  with  the  rules  that  came  later. 


Contractor  Responses  on  Ethics  Practices  Now  Required  by  the  FAR 

FAR  standard 

Contractors  reporting  these  practices 

Code  of  business  ethics  and 
conduct 

-  55  have  written  codes 

-  54  provide  copies  to  employees 

Ethics  awareness  and 
compliance  program 

-  55  have  ongoing  programs 

-  51  require  ethics  training  for  employees  and  managers  working 
on  DOD  contracts 

-  55  use  other  mechanisms  to  communicate  employee  ethics 
awareness  and  compliance 

Internal  control  system 

High  level  of  management 
oversight 

-  52  have  an  office  or  individual  charged  with  implementing  the 
ethics  program 

-  25  report  quarterly  top  management  oversight  of  ethics  program 
managers 

Periodic  reviews,  audits,  or 
both 

-  52  have  internal  reviews  or  audits  to  test  ethics  program 

-  47  periodically  assess  risks  of  improper  or  criminal  conduct 

Mechanisms  for  reporting 
misconduct 

-  55  have  internal  reporting  mechanisms,  such  as  hotlines 

-  54  have  a  policy  for  employees  to  report  anonymously  or 
confidentially 

Disciplinary  systems 

-  52  have  codes  that  provide  examples  of  disciplinary 
consequences,  such  as  counseling  and  termination 

Timely  disclosure 

-  Before  FAR  rule,  34  had  a  formal  policy  for  voluntary  disclosure 
to  DOD  of  contract-related  violations 

-  After  FAR  rule,  4  contractors  GAO  visited  changed  disclosure 
policy  to  comply  with  new  mandatory  disclosure  requirement 

Source:  GAO  analysis  of  contractor  survey. 


In  response  to  the  new  FAR  rules,  DOD  has  made  two  key  oversight 
improvements  by  revising  its  contract  audit  guidance  to  cover  the  new  ethics 
requirements  and  establishing  the  Contractor  Disclosure  Program  to 
implement  the  mandatory  disclosure  requirement.  However,  opportimities 
exist  to  improve  DOD’s  oversight  in  two  other  key  areas.  For  example,  in 
verifying  implementation  of  contractor  ethics  programs  during  contract 
administration,  the  impact  of  the  FAR  rules  on  oversight  at  this  point  is 
negligible.  GAO  found  that  DOD  had  no  plans  to  change  contract 
administration  offices’  oversight  because  authority  for  oversight  is  not  explicit 
nor  is  organizational  responsibility  clear.  Also,  with  regard  to  contractors’ 
hotline  poster  displays,  the  new  FAR  rules  could  reduce  DOD’s  awareness  of 
potential  violations.  The  rules  exempt  contractors  with  ethics  programs  that 
include  their  own  hotlines  from  the  requirement  to  display  DOD  hotline 
posters.  If  contractor  employees  report  violations  to  company  hotlines  instead 
of  DOD  hotlines,  the  employees  do  not  receive  the  same  protections  from 
whistleblower  laws.  Whistleblower  protections  for  employees  imaware  of  the 
DOD  hotline  could  be  jeopardized. 
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GAO 

^^^^^^^—^Accountability  *  Integrity  *  Reliability 

United  States  Government  Acconntability  Office 
Washington,  DC  20548 


September  22,  2009 
Congressional  Committees 

In  fiscal  year  2008,  the  Department  of  Defense  (DOD)  spent  more  than 
$387  billion  for  goods  and  services  from  more  than  85,000  contractors. 
Given  the  magnitude  of  taxpayer  money  at  stake,  it  is  essential  that 
defense  contractors  conduct  their  business  operations  with  integrity.  In 
the  last  several  years  there  have  been  a  number  of  cases  of  fraud,  waste, 
and  abuse  in  wartime  contracting  and  even  some  high-profile  criminal  and 
civil  convictions  of  large  defense  contractors  because  of  procurement 
integrity  and  foreign  corrupt  practices  violations.  These  procurement 
fraud  cases  heightened  concerns  in  Congress  and  the  executive  branch 
about  the  adequacy  of  defense  contractors’  ethics  programs  in  preventing 
or  addressing  misconduct  that  could  put  billions  of  dollars  of  contracted 
goods  and  services  at  risk. 

In  the  past,  DOD’s  policy  under  the  Defense  Federal  Acquisition 
Regulation  Supplement  (DFARS)  encouraged  contractors  to  have  written 
ethics  policies  and  recommended  practices,  such  as  ethics  training  for  all 
employees  and  hotlines  or  other  internal  mechanisms  for  them  to  report 
suspected  misconduct. '  Essentially,  defense  contractor  ethics  programs 
were  voluntary  and  self-policed.  Moreover,  our  prior  work  raised  concerns 
that  DOD  lacked  adequate  oversight  of  its  contractors’  ethics  programs, 
recommending  that  enhanced  knowledge  of  contractor  ethics  programs 
would  enable  DOD  to  assess  whether  the  public  trust  is  protected.^ 

Given  the  significant  sums  of  federal  dollars  spent  by  agencies  to  acquire 
goods  and  services,  and  the  need  to  establish  a  clear  and  consistent  policy 
regarding  contractor  code  of  ethics  and  business  conduct,  the  Federal 
Acquisition  Regulation  (FAR)  was  amended  twice  to  address  contractor 


^  DFARS  is  a  supplement  to  the  Federal  Acquisition  Regulation  (FAR)  that  provides  DOD- 
specific  regulations.  Among  its  requirements,  DFARS  contains  DOD-wide  policies  and 
deviations  from  FAR  requirements. 

^  GAO,  Defense  Ethics  Program:  Opportunities  Exist  to  Strengthen  Safeguards  for 
Procurement  Integrity,  GAO-05-341  (Washington,  D.C.:  Apr.  29,  2006).  In  concurring  with 
this  report,  DOD  stated  that  the  recommendation  to  assess  contractor  ethics  programs  was 
currently  implemented  when  contracting  officers,  before  awarding  a  contract,  make  an 
affirmative  determination  of  responsibility,  which  includes  consideration  of  the  potential 
contractor’s  business  practices  and  the  potential  contractor’s  integrity. 
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ethics  programs.  In  December  2007  and  again  in  December  2008,  the  FAR 
was  amended  first  to  mandate  and  then  to  amplify  governmentwide  ethics 
program  requirements  for  certain  contractors.^  Contractors’  internal 
programs  must  now  include  an  ethics  and  compliance  system  with  several 
practices  aimed  at  preventing  and  detecting  misconduct  and  at  promoting 
an  organizational  culture  that  encourages  ethical  conduct  and  a 
commitment  to  compliance  with  the  law.  Before  FAR  changes  were 
finalized  in  late  2008,  Congress  included  a  provision  in  the  National 
Defense  Authorization  Act  for  Fiscal  Year  2008  requiring  us  to  report  on 
the  internal  ethics  programs  of  major  defense  contractors — defined  as  any 
company  that  received  more  than  $500  million  in  DOD  contract  awards  in 
fiscal  year  2006 — and  the  extent  to  which  DOD  monitors  or  approves 
them.^  In  January  2009,  we  briefed  your  committees  on  the  preliminary 
results  regarding  the  reporting  requirements  specified  in  the  act.  Taking 
into  consideration  the  new  FAR  contractor  ethics  program  rules,  which 
are  very  similar  to  some  of  the  reporting  requirements  specified  in  the  act,® 
this  report  (1)  describes  the  extent  to  which  contractors  had  ethics 
programs  before  the  finalization  of  the  FAR  rules  that  included  practices 
consistent  with  standards  now  required  by  the  FAR  and  (2)  assesses  the 
impact  the  new  FAR  rules  have  on  DOD  oversight  of  contractor  ethics 
programs. 

To  select  contractors  for  review,  we  used  DOD’s  contract  award  data  and 
identified  57  major  defense  contractors  receiving  more  than  $500  million 
in  fiscal  year  2006  for  review.  To  obtain  information  on  contractor  ethics 
programs  and  practices,  in  September  2008  we  surveyed  all  57  contractors. 
We  also  obtained  corroborating  documentation  for  various  practices — 
including  those  consistent  with  the  FAR’s  standards,  such  as  management 
oversight  and  ethics  and  compliance  training — and  information  about  the 
benefits  to  contractors  and  the  challenges  they  face  in  implementing  the 
new  FAR  ethics  rules.  We  analyzed  responses  from  all  57  contractors  and 


®  Since  December  24,  2007,  contractors  receiving  awards  worth  more  than  $5  million  and 
involving  work  in  excess  of  120  days  have  been  required  to  have  a  written  code  of  business 
ethics  and  conduct.  However,  until  further  amended  effective  December  12,  2008,  the  rule 
did  not  apply  to  contracts  for  commercial  items  or  to  contracts  performed  outside  the 
United  States.  72  Fed.  Reg.  66873-82  (Nov.  23,  2007). 

''  The  National  Defense  Authorization  Act  for  Fiscal  Year  2008,  Pub.  L.  No.  110-181  §  848. 

®  App.  I  provides  a  side-by-side  comparison  in  table  10  of  the  ethics  program  elements 
identified  in  §  848  for  inclusion  in  this  report  with  those  contractor  ethics  program 
elements  now  required  by  the  FAR,  all  of  which  became  the  basis  for  our  survey  on  major 
defense  contractors’  ethics  programs.  Pub.  L.  No.  110-181  §  848  (2008). 
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reviewed  the  FAR  Council’s  disposition  of  public  comments  considered  as 
part  of  the  rulemaking  process  for  additional  perspectives  on  benefits  to 
contractors  and  challenges  they  face  implementing  new  ethics  program 
rules.®  While  we  reviewed  the  contractors’  self-reported  practices  for 
consistency  with  the  FAR  rules  that  came  later,  we  did  not  test  them  for 
effectiveness  or  compliance.  We  selected  a  nongeneralizable  sample  of 
four  contractors  for  site  visits  in  order  to  review  in  detail  implementation 
practices  for  some  of  the  ethics  program  policies  or  procedures  described 
in  their  survey  responses.  We  chose  these  four  contractors  because 
(1)  they  ranked  among  the  top  15  contractors  in  terms  of  dollar  value  of 
fiscal  year  2006  DOD  contract  awards  and  (2)  their  survey  responses 
indicated  that  they  had  such  policies  or  procedures  in  use. 

To  assess  the  impact  the  new  FAR  contractor  ethics  rules  have  on  DOD, 
we  focused  on  defense  and  military  organizations  responsible  for 
oversight  and  investigation  of  contractor  operations  and  improper 
business  practices.^  These  organizations  included  the  (1)  Defense  Contract 
Management  Agency  (DCMA);  (2)  Defense  Contract  Audit  Agency 
(DCAA);  (3)  DOD  Office  of  the  Inspector  General  (DOD  IG);  (4)  Air  Force, 
Army,  and  Navy  offices  responsible  for  suspension  and  debarment;  and 
(5)  Office  of  the  Under  Secretary  of  Defense  for  Acquisition,  Technology 
and  Logistics  (AT&L).  We  interviewed  senior  procurement  officials; 
general  counsel;  and  contract  administration,  audit,  and  investigative 
service  officials  concerning  these  agencies’  roles  and  responsibilities  for 
monitoring  or  approving  contractor  ethics  programs.  Through  interviews 
and  information  obtained  from  these  officials,  we  obtained  views  and 
reviewed  supporting  documentation  concerning  the  impact  the  new  FAR 
rules  have  had  or  could  have  on  DOD  contractor  oversight  activities 
related  to  monitoring  contractors’  compliance  with  ethics  program 
practices  required  by  the  new  rules.  We  did  not  test  DOD  agencies’ 


®  The  FAR  Council — whose  members  include  the  DOD  Director  of  Defense  Procurement 
and  Acquisition  Policy,  the  National  Aeronautics  and  Space  Administration  Associate 
Administrator  for  Procurement,  and  the  General  Services  Administration  Chief  Acquisition 
Officer — oversees  development  and  maintenance  of  the  FAR.  The  Office  of  Federal 
Procurement  Policy  Administrator  in  the  Office  of  Management  and  Budget  serves  as  chair 
of  the  FAR  Council,  which  meets  quarterly  to  discuss  and  resolve  significant  or 
controversial  FAR  changes. 

’’  For  purposes  of  this  report,  an  improper  business  practice  is  defined  as  a  known  or 
suspected  violation  of  federal  criminal  law  involving  fraud,  conflict  of  interest,  bribery,  or 
gratuity  violations  found  in  title  18  of  the  United  States  Code  or  a  violation  of  the  civil  False 
Claims  Act. 
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effectiveness  in  implementing  their  oversight  activities  related  to 
monitoring  contractor  ethics  programs. 

We  conducted  this  performance  audit  from  May  2008  through  August  2009 
in  accordance  with  generally  accepted  government  auditing  standards. 
Those  standards  require  that  we  plan  and  perform  the  audit  to  obtain 
sufficient,  appropriate  evidence  to  provide  a  reasonable  basis  for  our 
findings  and  conclusions  based  on  our  audit  objectives.  We  believe  that 
the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives.  Appendix  1  provides  additional 
details  on  our  scope  and  methodology,  including  a  list  of  the  57 
contractors  reviewed. 


Background 


Defense  Contractor  Ethics  Before  the  far  changes  in  December  2007,  DFARS  provided  that 

and  DOD  contractors  must  conduct  themselves  with  the  highest  degree  of  integrity 

before  New  FAR  honesty.*^  Specifically,  defense  regulations  provided  that  contractors 

should  have  (1)  a  written  code  of  ethical  conduct;  (2)  ethics  training  for  all 
employees;  (3)  periodic  reviews  of  compliance  with  their  code  of  ethical 
conduct;  (4)  internal  audits,  external  audits,  or  both;  (5)  disciplinary 
action  for  improper  conduct;  (6)  timely  reporting  to  appropriate 
government  officials  of  any  suspected  violation  of  law  regarding 
government  contracts;  and  (7)  full  cooperation  with  any  government 
agencies  responsible  for  either  investigation  or  corrective  action.'’  While 
defense  regulations  provided  that  contractors  should  have  such  elements, 
they  were  not  mandatory.  As  a  result,  under  DFARS  and  until  the  FAR 
rules  established  mandatory  ethics  program  requirements,  DOD  relied  on 
contractor  self-governance — through  which  a  company  decided  if  and  how 
to  implement  and  enforce  ethical  conduct. 


Programs 

Oversight 


Oversight  and  management  of  DOD  contracting  activities  is  shared  among 
various  organizations.  Collectively,  these  organizations  help  detect 
instances  of  fraud,  waste,  and  abuse;  try  to  prevent  them  from  happening; 


48  C.F.R.  §  203.7000  (2007). 
48  C.F.R.  §  203.7001  (2007). 
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or  are  involved  in  correcting  policies  and  procedures  when  they  occur.  “ 
For  example,  the  Office  of  the  Under  Secretary  of  Defense  for  AT&L 
provides  policy,  guidance,  and  oversight  to  acquisition  functions.  Other 
DOD  organizations  may  examine  contractors’  ethics  programs  under  a 
range  of  authorities  for  contract  administration  and  audit  services.  Table  1 
shows  DOD  organizations  involved  in  overseeing  and  managing 
contracting  activities  and  their  primary  responsibilities  in  examining 
contractors’  ethics  programs. 

Table  1 :  DOD  Organizations  Responsible  for  Oversight  and  Management  of  DOD  Contracting  Activities  in  Which  Contractor 
Ethics  Programs  May  Be  Examined 

DOD  organization 

Responsibility 

Contract  audit  services  and  administration 

DCAA 

Located  on-site  at  contractor  faciiities  for  ongoing  contract  audit  purposes,  DCAA  audits  internai 
controi  systems— inciuding  the  contractor's  controi  environment  for  integrity  and  ethicai  vaiues— every 

3  to  4  years,  and  reports  on  adequacy  of  controis.  According  to  DCAA,  the  contractor's  controi 
environment  has  a  pervasive  infiuence  on  its  business  activities  and  is  the  foundation  foraii  other 
internai  controi  systems,  such  as  biiiing  and  iabor.  DCAA  aiso  makes  investigation  referrais,  usuaiiy  to 
the  DOD  iC,  regarding  situations  that  reasonabiy  appear  to  entaii  fraud  that  it  encounters  during  its 
contract  audits. 

DCMA 

DCMA  is  a  combat  support  agency  responsibie  for  ensuring  the  integrity  of  contractuai  processes  and 
provides  a  broad  range  of  contract  and  procurement  management  services  to  DOD  buying 
organizations.  As  of  December  2008,  DCMA  reports  managing  291,000  prime  contracts  vaiued  at 
$950  biiiion.  Aiso  iocated  on-site  for  ongoing  contract  administration  purposes,  as  needed,  DCMA 
monitors  ethics  program  corrections  in  response  to  DCAA-identified  deficiencies. 

Improper  business  practices 

DOD  IG 

DOD  iG  conducts  audits  and  oversees  matters  reiating  to  detection  and  prevention  of  fraud,  waste, 
and  abuse,  and  coiiaborates  with  numerous  other  DOD  entities,  as  many  activities  are  invoived  in 
addressing  these  issues  across  DOD.  DOD  iC  does  not  monitor  contractor  ethics  programs  perse, 
but  may  get  insight  through  oversight  of  and  foiiow-up  on  irreguiarities  or  misconduct  reported  through 
DCAA,  the  Defense  Flotiine  Program,  and  the  DOD  Contractor  Disciosure  Program. 

Air  Force,  Army,  and  Navy 
offices  of  generai  counsei 
suspension  and  debarment 
officiais 

During  any  administrative  suspension  or  debarment  proceeding  or  in  reaching  an  administrative 
settiement,  the  contractor's  ethics  program  may  come  under  the  review  and  approvai  of  the  agency's 
suspension  and  debarment  officiai.  Forexampie,  under  separate  administrative  compiiance 
agreements  from  March  2005  through  October  2007,  the  Air  Force  and  Army  suspension  and 
debarment  officiais  approved  changes  in  and  poiiced  compiiance  with  ethics  programs  of  two 
contractors  in  our  study. 

Sources:  DOD  and  FAR  (information):  GAO  (anaiysis  and  presentation). 

See  also  GAO,  Contract  Management:  DOD  Vulnerabilities  to  Contracting  Fraud, 

Waste,  and  Abuse,  GAO-06-838R  (Washington,  D.C.:  July  7,  2006). 
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Concerns  over 
Procurement  Fraud  Trends 
Prompt  FAR  Contractor 
Ethics  Rules 


A  number  of  cases  involving  fraud  in  wartime  contracting  in  Iraq,  Kuwait, 
and  Afghanistan  and  recent  scandals  involving  high-profile  defense 
contractors  have  prompted  significant  changes  in  procurement  fraud 
investigations,  enforcement  initiatives,  legislation,  and  regulation.  By  2007, 
in  view  of  the  trend,  the  FAR  Council  commented  that  the  DFARS 
provision  that  contractors  should  have  specific  elements  of  an  ethics 
program  was  no  longer  considered  strong  enough  to  increase  contractor 
compliance  with  ethical  rules  of  conduct. 


To  address  this  problem,  the  FAR  Council  changed  the  regulations.  After 
conducting  an  extensive  proposed  rulemaking  and  public  comment 
process  from  February  2007  through  November  2008,  the  FAR  Council 
twice  amended  the  FAR  to  impose  new  ethics  requirements  on 
government  contractors.  The  initial  rule — effective  in  December  2007 — 
created  a  new  FAR  subpart  that  requires  government  contractors  to  have 
written  codes  of  business  ethics  and  ethics  compliance  training  programs 
for  contractor  employees  and  to  post  “fraud  hotline”  posters  at  contractor 
work  sites  to  encourage  contractor  employees  to  report  fraudulent  activity 
in  connection  with  performance  and  award  of  government  contracts. 


However,  in  December  2008  certain  shortcomings  in  the  initial  contractor 
ethics  rules  were  addressed  in  further  amendments  to  the  FAR.^^  For 
example,  public  concerns  over  the  first  rule’s  exemption  connected  to 
overseas  contracting  prompted  elimination  of  this  exemption  in  the 
second  rule,  and  as  of  December  2008,  overseas  and  commercial 
contractors  are  now  required  to  maintain  written  codes  of  business  ethics 
and  conduct.  In  addition,  the  amended  FAR  contractor  ethics  rules  now 
require  contractors  to  disclose  violations  of  criminal  law  involving  fraud, 
conflict  of  interest,  bribery,  or  gratuity  violations  or  violations  of  the  civil 
False  Claims  Act  (31  U.S.C.  3729-3733)  in  connection  with  award  or 
performance  of  government  contracts  and  subcontracts.  It  should  be 
noted  that  these  requirements  are  implemented  by  contract  clause  and  are 


“  72  Fed.  Reg.  66876  (Nov.  23,  2007). 

72  Fed.  Reg.  65873-82  (Nov.  23,  2007). 

On  June  30,  2008,  Congress  enacted  the  Close  the  Contractor  FYaud  Loophole  Act  as  part 
of  the  Supplemental  Appropriations  Act,  2008.  The  act  requires  the  FAR  to  include 
provisions  that  require  timely  notification  by  federal  contractors  of  violations  of  federal 
criminal  law  or  overpayments  in  connection  with  the  award  or  performance  of  covered 
contracts  or  subcontracts,  including  those  performed  outside  the  United  States  and  those 
for  commercial  items.  Supplemental  Appropriations  Act,  2008,  Pub.  L.  No.  110-252,  Title  VI, 
ch.  1. 
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mandatory. The  amended  rules  also  specifically  subject  contractors  to 
suspension  and  debarment  from  government  contracting  for  knowingly 
failing  to  disclose  such  violations  and  failing  to  disclose  receipt  of 
overpayments  on  government  contracts  in  a  timely  manner. 

The  FAR  changes  effective  in  December  2008  also  enhance  provisions  for 
sound  ethics  business  practices  by  specifically  requiring  the  establishment 
of  internal  control  systems  for 

•  facilitating  discovery  of  improper  conduct, 

•  ensuring  that  corrective  measures  are  promptly  carried  out,  and 

•  otherwise  promoting  an  organizational  culture  that  encourages  ethical 
conduct  and  a  commitment  to  compliance  with  the  law. 

In  publishing  the  December  2008  rule’s  amplified  requirements,  the  FAR 
Council  stated  that  the  U.S.  Sentencing  Commission’s  federal  sentencing 
guidelines  are  the  source  of  the  FAR  text,  which  provides  guidance  for 
contractors  consistent  with  the  guidelines  on  effective  compliance  and 
ethics  programs  for  organizations.  Among  other  things,  the  sentencing 
guidelines  state  that  an  ethics  and  compliance  program  should  be 
reasonably  designed,  implemented,  and  enforced  so  that  it  is  generally 
effective  in  preventing  and  detecting  criminal  conduct.  Notably,  the 
sentencing  guidelines  also  state  that  the  failure  to  prevent  or  detect  a 
particular  offense  does  not  necessarily  mean  that  the  program  is  generally 
ineffective  in  preventing  and  detecting  criminal  conduct. 

According  to  the  FAR  Council,  the  final  rule  reflects  standards  across  four 
broad  components  and  establishes  a  framework  for  institutional  ethics 
management  and  disclosure,  but  does  not  prescribe  specific  ethical 
requirements.  Contractors  are  free  to  establish  the  appropriate  ethical 
standards  for  their  businesses.  For  a  more  detailed  description  of  the  final 
rule’s  establishment  of  standards  across  four  broad  components,  see 
appendix  II. 


“far  §3.1004. 


Page  7 


GAO-09-591  DOD  Contractor  Ethics  Programs 


Contractors  Report 
Using  a  Range  of 
Ethics  Program 
Practices  Now 
Required  by  the  FAR 


In  September  2008  and  before  the  FAR  rules  were  finalized,  to  identify 
contractor  ethics  program  practices,  we  surveyed  all  57  contractors  to 
obtain  information  on  the  extent  to  which  their  programs  included 
practices  required  or  proposed  in  the  FAR  or  otherwise  addressed  in 
congressional  requirements  for  this  report.  As  summarized  in  table  2, 
nearly  all  of  the  57  contractors  responding  to  our  survey  report  using 
many  of  the  ethics  practices  consistent  with  standards  now  required  by 
the  FAR.  The  ethics  program  practices  information  we  obtained  was  not 
designed  to  test  contractor  compliance  with  the  rules  that  came  later. 

Table  2:  Contractor  Responses  on  Ethics  Practices  Now  Required  by  the  FAR 

FAR  standard  Contractors  reporting  these  practices 

Code  of  business 
ethics  and  conduct 

55  have  written  codes 

54  provide  copies  to  employees 

Ethics  awareness 
and  compliance 
program 

• 

55  have  ongoing  programs 

51  require  ethics  training  for  employees  working  on  DOD 
contracts 

55  use  other  mechanisms  to  communicate  employee  ethics 
awareness  and  compliance 

Internal  control  system 

High  level  of 

management 

oversight 

52  have  an  office  or  individual  charged  with  implementing 
the  ethics  program 

25  report  quarterly  top  management  oversight  of  ethics 
program  managers 

Periodic  reviews, 
audits,  or  both 

• 

52  have  internal  audit  functions  that  review  ethics  program 
effectiveness 

47  periodically  assess  risks  of  improper  or  criminal  conduct 

Internal  mechanism  • 
for  reporting 
misconduct 

55  have  internal  reporting  mechanisms,  such  as  hotlines 

54  have  a  policy  for  employees  to  report  misconduct 
anonymously  or  confidentially 

Disciplinary 

systems 

52  have  codes  that  provide  examples  of  disciplinary 
consequences,  for  example,  warning,  counseling,  and 
employment  termination 

Timely  disclosure 

• 

Before  FAR  rule,  34  had  a  policy  for  voluntary  disclosure  to 
DOD  of  contract-related  violations  and  misconduct 

Post  FAR  rule,  4  contractors  we  visited  for  follow-up 
changed  disclosure  policy  and  procedure  to  comply  with 
new  mandatory  disclosure  requirement 

Source:  GAO  analysis  of  contractor  survey. 
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Notes:  Atthe  time  of  oursurvey,  contracts  forthe  acquisition  of  commerciai  items  and  those  that 
wouid  be  performed  entireiy  outside  the  United  States  were  exemptfrom  the  requirements  shown  in 
the  tabie,  and  none  of  the  contractors  were  required  to  timeiy  disciose  credibie  evidence  of  certain 
vioiations  of  federai  criminai  iaw  orofthe  civii  Raise  Ciaims  Act  In  addition,  aii  smaii  businesses  are 
exemptfrom  the  FAR  requirements  for  an  ethics  awareness  and  compiiance  program  and  an  internai 
controi  system.  In  this  tabie  and  throughout  this  report,  we  present  data  on  the  number  of  affirmative 
responses  and  not  data  on  the  number  of  "no"  and  "don't  know"  responses  or  the  number  of 
contractor  nonresponses  to  a  question. 


Views  of  contractors  surveyed  were  mixed  with  regard  to  the  benefits  and 
challenges  they  face  in  implementing  the  FAR  contractor  ethics  rules. 
Contractors  responding  to  our  survey  cited  several  expected  benefits  and 
challenges  of  the  new  ethics  rules.  Other  benefits  and  challenges  were 
attributed  by  the  FAR  Council  to  public  comments  from  contractor 
industry  and  other  sources  when  finalizing  the  new  FAR  contractor  ethics 
rules  in  2008.  Some  of  these  benefits  and  challenges  are  highlighted  in 
table  3. 
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Table  3:  Highlights  of  GAO  Contractor  Survey  and  FAR  Public  Comments  regarding  Benefits  to  Contractors  and  Challenges 
They  Face  in  Implementing  FAR  Ethics  Rules 


Contractor  benefits  from  implementing  FAR  ethics  rules 

•  Codify  good  business  practices  for  aii  contractors  and  reinforce  importance  that  aii  businesses  conduct  themseives  in  an  ethicai 
manner. 

•  Contribute  to  a  company  cuiture  emphasizing  business  integrity. 

•  Provide  standard  and  create  a  ievei  piaying  fieid. 

•  Buiid  empioyee  trust  and  confidence. 

•  Reduce  contractor  iiabiiity  and  risk. 

•  Assist  contractors  subject  to  simiiar  responsibiiities  or  federai  sentencing  guideiines  if  accused  of  crimes. 

•  Benefitthe  government  procurement  process  as  a  whoie. 

•  Reinforce  companies'  compiiance  standards  and  inhibit  unethicai  conduct. 

•  Provide  basis  for  government  partners  to  evaiuate  contractor's  responsibiiity  and  are  meaningfui  for  enforcement  when  something 
goes  wrong. 

Contractor  challenges  in  implementing  FAR  ethics  rules 

Mandatory  disclosure 

•  In  contrast  to  existing  government  programs  and  contractor  initiatives  offering  ample  incentives  to  voluntarily  report  contract 
violations,  mandatory  disclosure  may  eliminate  the  ability  of  a  contractor  to  claim  the  benefit  of  'timely  and  voluntary  disclosure"  to 
the  government  if  the  contractor  is  charged  with  a  crime. 

•  Failure  to  disclose  an  overpayment  on  a  government  contract  may  create  operational  difficulties  because  (1)  contracts  are  subject 
to  reconciliation  processes  with  payments  audited  and  adjusted  overtime  and  (2)  the  routine  nature  of  contract  payment  issues, 
which  are  daily  events,  with  errors  on  both  sides,  is  simply  unworkable. 

•  Challenge  to  interpret  vague  language,  such  as  "suspected,"  "cooperation,"  "timely,"  and  "reasonable  grounds  to  believe,"  may  tie 
up  government  resources  in  meaningless  legal  trivia. 

•  If  contractor  employees  know  that  everything  they  report  will  be  passed  on  to  the  government,  this  may  result  in  less  reporting  up 
the  chain  of  the  company  rather  than  more  and  could  decrease  rather  than  enhance  cooperation  with  company  ethics  compliance 
efforts. 

Other  challenges 

•  Expanding  our  awareness  program  to  keep  pace  with  our  company  growth. 

•  Ensuring  sufficient  training  for  significant  number  of  employees. 

•  Executing  the  requirement  for  checking  the  existence  of  subcontractor  ethics  awareness  and  internal  control  systems. 

•  Utilizing  a  covered  subcontractor  outside  the  United  States,  as  we  would  expect  that  many  foreign  companies  may  not  have 
programs  that  are  as  stringent  as  is  required  by  the  FAR,  and  it  could  be  difficult  in  some  countries  to  fund  a  subcontractor  with 
such  a  program. 


Sources:  GAO  analysis  of  contractor  survey  and  73  Fed.  Reg.  67064-93. 


With  regard  to  the  new  FAR  rule’s  mandatory  timely  disclosure  of  certain 
contract-related  violations  of  criminal  law  or  the  False  Claims  Act,  several 
contractors  responding  to  our  survey  as  well  as  industry  concerns  cited  in 
public  comments  indicated  that  contractors  would  face  significant 
difficulty  in  implementing  those  requirements.  In  response  to  these 
concerns,  the  FAR  Council  revised  key  aspects  of  the  final  rule  regarding 
timely  disclosure,  including  to 
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•  more  closely  focus  the  situations  that  must  be  disclosed  by  limiting 
violations  of  criminal  law  to  certain  violations  involving  fraud,  conflict  of 
interest,  bribery,  or  gratuity  violations  that  have  occmred  in  cormection 
with  the  award,  performance,  or  closeout  of  a  contract  or  subcontract; 

•  make  “credible  evidence”  the  standard  for  when  timely  disclosure  should 
occur; 

•  add  clarification  that  if  a  violation  relates  to  more  than  one  government 
contract,  the  contractor  may  make  the  disclosure  to  the  agency  officials 
responsible  for  the  largest  dollar  value  contract  affected  by  the  violation; 
and 

•  limit  the  application  of  suspension  or  debarment  to  undisclosed 
overpayment  cases  in  which  the  amount  is  significant.  “ 


Contractors’  Ethics  Highlighted  below  is  some  of  the  aggregated  analysis  resulting  from  the 

Program  Practices  survey  about  contractors’  ethics  practices.  A  more  complete  tabulation  of 

survey  questions  together  with  tables  indicating  the  levels  of  response  can 
be  found  in  the  e-supplement  to  this  report,  found  on  our  Web  site  at 
http://redesign-www.gao.gov/special.pubs/gao-09-646sp/index.html. 

Nearly  All  Contractors  Report  purpose  of  a  code  of  conduct  can  be  to  communicate  a  company’s 

Having  a  Code  of  Business  statement  of  ethical  values  and  integrity  as  established  by  top  leadership. 

Ethics  and  Conduct  Although  the  FAR  does  not  specify  what  topics  a  contractor  must  include 

in  its  code  of  conduct,  they  can  cover  a  broad  range  of  business  ethics  and 
conduct  standards,  such  as  conflict  of  interest,  relationships  with  vendors, 
and  compliance  with  government  contracting  requirements  for 
procurement  integrity,  classified  information,  and  recruiting  and 
employing  current  or  former  government  personnel,  according  to  sources 


In  finalizing  the  rule,  the  FAR  Council  dechned  to  expressly  define  “significant 
overpayment”  in  response  to  concerns  raised  in  the  public  comments.  Instead,  FAR 
Council  comments  indicated  that  “significant  overpayment”  implies  more  than  just  dollar 
value  and  depends  on  the  circumstances  of  the  overpayment  as  well  as  the  amount.  More 
specifically,  it  is  the  type  of  overpayment  that  the  contractor  knows  wiU  result  in  unjust 
enrichment  and  yet  fails  to  disclose.  As  part  of  the  comments,  it  was  also  noted  that  since 
contractors  are  required  by  the  FAR’s  payment  clauses  to  report  and  return  overpayments 
of  any  amount,  it  is  within  the  discretion  of  the  suspension  and  debarment  official  to 
determine  whether  an  overpayment  is  significant. 
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Nearly  All  Contractors  Report 
Having  an  Ethics  Awareness 
Program,  Compliance  Program, 
or  Both 


on  government  contractor  ethics  practices.  “  As  shown  in  table  4,  nearly  all 
of  the  contractors  reported  using  such  practices. 


Table  4:  Contractor  Responses  on  Practices  Now  Required  by  the  FAR  for  Code  of 
Business  Ethics  and  Conduct 


FAR  standard 

Contractors  reporting  this  practice 

Written  code  of  business 
ethics  and  conduct 

•  55  report  having  written  codes 

•  49  report  that  their  codes  Include  standards  of  business 
ethics  and  conduct  expected  of  employees  In  their  work 
on  DOD  contracts 

Copy  of  the  code 
available  to  employees 
engaged  In  contract 
performance 

•  54  provide  written  or  electronic  copies  of  code  to 
employees 

•  51  require  employee  acknowledgment  that  they 
understand  code 

•  52  require  employees  to  agree  to  uphold  the  ethics 

standards 


Source:  GAO  analysis  of  contractor  survey. 

Note:  At  the  time  of  our  survey,  contracts  for  the  acquisition  of  commerciai  items  and  those  thatwouid 
be  performed  entireiy  outside  the  United  States  were  exempt  from  the  requirements  for  the  code  of 
business  ethics  and  conduct 


One  purpose  of  ongoing  contractor  ethics  awareness  and  compliance 
programs  can  be  to  promote  conformance  with  the  code  of  business  ethics 
and  requirements.  Such  programs  should  include  reasonable  steps  to 
communicate  periodically  to  employees  about  the  contractor’s  ethics 
standards  and  procedures  via  training  programs  and  communicating 
information  on  individuals’  roles  and  responsibilities  under  the  ethics 
program.  As  shown  in  table  5,  nearly  all  of  the  contractors  reported 
including  steps  such  as  requiring  ethics  training  and  periodically 
communicating  ethics-related  information  to  employees  working  on  DOD 
contracts. 


See  The  Defense  Industry  Initiative  on  Business  Ethics  and  Conduct,  2007  Annual 
Public  Accountability  Report  (Washington,  D.C.,  2008);  Tara  A.  Edwards  and  Frank 
Spasoff,  “Compliance  with  the  New  FAR  Ethics  and  Internal  Control  Requirements,” 
Contract  Management  (April  2009):  34-42;  and  Terrence  M.  O’Cormor,  Federal 
Procurement  Ethics:  The  Complete  Legal  Guide  (Vienna,  Va.:  Management  Concepts, 
2009). 
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Table  5:  Contractor  Responses  on  Business  Ethics  and  Awareness  Practices  for 
Communicating  Information  concerning  Individual  Roles  and  Responsibilities 


FAR  standard 

Number  of  contractors 
reporting  this  practice 

Have  ongoing  ethics  awareness  programs,  ethics 
compliance  programs,  or  both 

55 

Training  required  for  contractors’  principals  and  employees  and,  as  appropriate, 
the  contractors’  subcontractors 

•  Principals  (officers,  directors,  executives,  etc.) 

48 

•  Midlevel  managers 

51 

•  Permanently  hired  employees 

50 

•  Short-term  employees 

37 

•  Independent  contractors/consultants 

12 

•  Employees  working  overseas 

41 

•  Foreign  employees 

38 

•  Subcontractor  employees 

4 

Periodic  communication  mechanisms  to  disseminate  information  appropriate  to 
individuals  working  on  contracts  on  their  ethics  roles  and  responsibilities 

•  Orientation 

54 

•  Staff  meetings 

43 

•  Brochures 

36 

•  One  or  more  other  communication  mechanisms 
(newsletter,  e-mail,  posters,  etc.) 

55 

Source:  GAO  analysis  of  contractor  survey. 

Notes:  The  standards  reflected  in  the  FAR  establish  a  framework  for  institutional  ethics  management 
and  are  displayed  above  in  bold.  As  shown  in  the  bulleted  text  above,  because  the  FAR  does  not 
prescribe  specific  ethical  requirements,  our  survey  included  multiple-choice  questions  about  the  types 
of  (1)  employees  to  whom  contractors  provided  ethics  training  and  (2)  periodic  communication 
mechanisms  used. 


All  41  contractors  that  reported  having  overseas  contract  operations 
indicated  that  they  had  incorporated  their  ethics  awareness  and 
compliance  programs  overseas.  However  26  contractors  reported 
experiencing  challenges  implementing  ethics  programs  overseas,  including 
differences  in  legal  and  regulatory  environments  relating  to,  for  example, 
employee  privacy,  cultural  and  language  barriers,  and  technical  or  hostile 
conditions  impeding  computer-based  training. 


Page  13 


GAO-09-591  DOD  Contractor  Ethics  Programs 


Internal  Control  Systems 


Having  contractors  implement  internal  control  systems  increases  the 
likelihood  that  their  ethics  and  compliance  programs  are  generally 
effective  in  preventing,  detecting,  and  addressing  contract-related  fraud, 
waste,  and  abuse.  Nearly  all  of  the  contractors  in  our  survey  reported 
using  internal  control  practices  consistent  with  the  FAR’s  standards. 

•  High-level  of  management  oversight.  By  assigning  responsibility  at  a 
sufficiently  high  level  and  providing  adequate  staffing  to  ensure  the 
effectiveness  of  the  ethics  program,  a  contractor  can  demonstrate  true 
interest  and  involvement  of  management.  As  shown  in  table  6,  most 
contractors  report  formally  assigning  responsibility  and  staff  resources  to 
an  office  or  individual  and  several  have  their  ethics  managers  report  on  a 
regular  basis  to  top  management.  Site  visits  with  four  contractors  showed 
that  all  had  ongoing  and  active  high-level  management  oversight  of  their 
ethics  programs. 


Table  6:  Contractor  Responses  on  Assignment  of  Ethics  Program  Responsibility 
and  High-Level  Oversight 

Practice 

Number  of  contractors 
reporting  this  practice 

Formally  assign  responsibility  to  an  office  or  Individual  to 
Implement  ethics  and  compliance  program 

52 

Regular  reporting  about  business  ethics  awareness  and 
compliance  to  these  management  levels 

•  Chief  executive  officer 

25  (quarterly):  7  (monthly) 

•  President 

17  (quarterly):  4  (monthly) 

•  Board  of  directors 

15  (quarterly):  0  (monthly) 

•  Board  ethics  committee,  compliance  committee,  or 
both 

10  (quarterly):  0  (monthly) 

Source:  GAO  analysis  of  contractor  survey. 


Notes:  The  standards  reflected  in  the  FAR  establish  a  framework  for  institutional  ethics  management 
Because  the  FAR  does  not  prescribe  specific  ethical  requirements  for  assignment  of  responsibility  at 
high  levels  for  program  responsibility  or  management  oversight  our  survey  included  open-ended  and 
multiple-choice  questions  about  the  types  of  (1)  individuals  or  offices  responsible  for  the  ethics  and 
compliance  program  and  (2)  periodic  reporting  to  various  management  levels.  Atthe  time  of  our 
survey,  contracts  forthe  acquisition  of  commercial  items  and  those  thatwould  be  performed  entirely 
outside  the  United  States  were  exemptfrom  the  internal  control  system  requirements  for 
management  oversight  Although  the  FAR  exempts  small  businesses  from  the  internal  control  system 
requirements,  nearlyall  contractors  told  us  thatthey  are  notsmall  businesses.  Flowever,  ifa 
contractor  did  not  report  assigning  responsibility  to  implement  an  ethics  and  compliance  program,  we 
did  not  verify  whether  the  company  mightfall  underthe  commercial  item  or  overseas  exemptions. 


Edwards  and  Spasoff,  40. 
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Periodic  reviews  and  audits.  An  internal  control  system  should  be 
reviewed  regularly  from  a  compliance  perspective  through  periodic  risk 
assessments  and  audits.  Most  of  the  contractors  reported  a  range  of 
practices  for  periodic  reviews  and  audits,  as  shown  in  table  7.  In  the  case 
of  our  four  site  visits,  we  confirmed  that  all  four  contractors  had  internal 
audits  or  reviews  of  their  ethics  program  as  recently  as  2008.  Examples  of 
risk  areas  addressed  by  these  contractors’  internal  ethics  program  audits 
include  procurement  integrity,  foreign  corrupt  practices,  and  compliance 
with  the  code  of  conduct  and  policy  for  employee  background  checks. 


Table  7:  Contractor  Responses  on  Periodic  Reviews  and  Audits 

Practice 

Number  of  contractors 
reporting  this  practice 

Internal  audit  or  review  function  that  audits  business  ethics 
program 

52 

Mechanisms  to  monitor  effectiveness  of  ethics  program 

•  Periodic  evaluation  of  business  practices,  procedures, 
policies,  and  internal  controls 

52 

•  Periodic  assessments  of  the  risk  of  improper  or  criminal 
conduct 

47 

•  Program  modifications  in  response  to  risk  assessment  to 
reduce  risk  of  improper  or  criminal  conduct 

46 

•  Monitoring  and  auditing  to  detect  improper  or  criminal 
conduct 

49 

Source:  GAO  analysis  of  contractor  survey. 


Internal  mechanism  for  reporting  misconduct.  Having  and  publicizing  a 
system  such  as  a  hotline  through  which  employees  can  anonymously  and 
confidentially  report  or  seek  guidance  facilitates  detecting  and  addressing 
unethical  and  illegal  activity  related  to  contracts  and  helps  promote  a 
culture  that  encourages  ethical  conduct  and  a  commitment  to  compliance 
with  the  law.  “  As  shown  in  table  8,  most  of  the  contractors  reported 
having  such  mechanisms  and  policies  for  employees  to  anonymously  or 
confidentially  report  suspected  misconduct  and  contract-related 
violations. 


Edwards  and  Spasoff,  41,  and  O’Connor,  7-10. 

United  States  Sentencing  Commission,  Guidelines  Manual,  §  8B2.1  (November  2007). 
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Table  8:  Contractor  Responses  on  Anonymous/Confidential  Reporting  of 

Misconduct  and  Contract-Related  Violations 

Practice 

Number  of  contractors 
reporting  this  practice 

Policy  for  employees  to  anonymously  and/or  confidentially 
report  known  or  suspected  conduct  that  violates  ethics 
standards  or  contract-related  requirements 

54 

One  or  more  mechanisms  for  reporting  such  known  or 
suspected  conduct 

55 

•  Hotline/helpline 

54 

•  Ethics  officers 

45 

•  Ethics/compliance  office  telephone  number 

49 

•  E-mail 

53 

Source:  GAO  analysis  of  contractor  survey. 


In  addition,  of  the  57  contractors  responding  to  our  survey,  45  reported 
using  one  or  more  mechanisms  (for  example,  posters  or  training)  to  let 
employees  know  about  external  mechanisms  for  reporting  contract- 
related  misconduct,  such  as  DOD  IG’s  hotline,  and  55  reported  notifying 
employees  of  their  federal  whistleblower  protections  through  one  or  more 
mechanisms,  such  as  their  ethics  codes  or  training.^'’ 

Disciplinary  systems.  A  disciplinary  system  is  part  of  providing 
appropriate  incentives  to  perform  in  accordance  with  the  ethics  and 
compliance  program  and  further  demonstrates  appropriate  follow-through 
in  investigating,  disciplining,  and  correcting  ethics  violations.  As  shown 
in  table  9,  53  of  the  57  contractors  report  including  a  disciplinary  system  in 
their  ethics  programs,  with  consequences  ranging  from  warning  to 
termination  practices.  To  ensure  that  prompt  corrective  measures  are 
carried  out  when  violations  are  substantiated,  35  of  the  contractors 


Since  January  2009,  10  U.S.C.  §  2409  and  41  U.S.C.  §  251  et  seq.  address  protections  for 
contractor  employees  who  disclose  information  to  government  officials  with  regard  to 
waste  or  mismanagement,  danger  to  public  health  or  safety,  or  violation  of  law  related  to  a 
DOD  contract  or  grant.  Specifically,  an  employee  may  not  be  discharged,  demoted,  or 
otherwise  discriminated  against  as  a  reprisal  for  disclosing  to  the  government  information 
concerning  contract-related  violations.  As  of  January  2009,  DOD  regulations  also  require 
contractors  to  inform  their  employees  in  writing  of  these  federal  whistleblower  rights  and 
protections.  DFARS  Subpart  203.970. 

James  C.  Fontana,  J.  Scott  Hommer  III,  and  Peter  A  Riesen,  “The  Brave  New  World  of 
Government  Contractor  Compliance  Programs:  Maximizing  Effectiveness  and  Minimizing 
Risk,”  Contract  Management  (January  2009):  48-59. 
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Timely  Disclosure 


reported  such  practices  as  having  specific  offices  or  individuals,  while  12 
reported  having  committees,  responsible  for  coordinating  and  tracking 
that  appropriate  discipline  is  administered.  Site  visits  with  4  contractors 
confirmed  that  all  4  kept  extensive  records  for  management  to  track  and 
oversee  disciplinary  actions  by  category  of  conduct  violation,  employee 
category,  and  business  unit. 


Table  9:  Contractor  Responses  on  Ethics-Related  Disciplinary  Action 

Practice 

Number  of  contractors 
reporting  this  practice 

Code  of  ethics  states  that  there  will  be  disciplinary 
consequences  for  conduct  that  violates  organization's 
business  ethics  and  standards 

53 

Code  of  ethics  provides  examples  of  potential  disciplinary 
consequences,  such  as  warning,  counseling,  and 
employment  termination 

52 

Source:  GAO  analysis  of  contractor  survey. 


Since  the  FAR  rule  mandating  timely  disclosure  of  contractors’  credible 
evidence  of  violations  was  not  yet  in  effect  at  the  time  of  our  survey,  we 
asked  contractors  about  policies  for  voluntarily  disclosing  to  DOD 
conduct  in  connection  with  defense  contracts  that  may  violate  applicable 
requirements  of  law  or  regulation.  Of  the  57  contractors  responding  to  the 
survey,  39  indicated  that  they  had  self-reporting  policies.  Of  these,  34  said 
that  their  policy  was  to  voluntarily  disclose  or  self-report  violations  to 
government  officials,  such  as  DOD  IG,  contracting  officers,  DCMA,  and 
DCAA.  Fifteen  of  these  contractors  provided  copies  of  their  self-reporting 
policies.  Of  the  18  that  indicated  that  they  did  not  have  self-reporting 
policies,  10  said  it  was  their  practice  to  self-report  or  voluntarily  disclose, 
or  to  encourage  the  practice  of  self-reporting,  violations  to  government 
officials.  In  addition,  some  of  the  contractors  that  had  self-reporting 
policies  reported  that  the  types  of  contract-related  violations  subject  to 
their  self-disclosure  policies  and  practices  included 

•  violations  of  law  and  instances  of  significant  employee  misconduct, 

•  instances  where  there  may  have  been  overbilling  caused  by  employee 
mischarging  and  other  instances  of  misconduct, 

•  violation  of  the  Anti-Kickback  Act  of  1986, 

•  compromise  of  product  integrity, 

•  violations  of  federal  procurement  law, 

•  violations  that  added  costs  to  the  government, 

•  cost  accounting  violations,  and 

•  suspected  fraud. 
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Notably,  in  site  visits  with  four  contractors  following  the  November  2008 
publication  of  the  FAR’s  mandatory  rule  for  timely  disclosure  of  certain 
contract-cormected  violations,  senior  ethics  program  managers  provided 
us  information  showing  that  all  organizations  were  changing  their 
voluntary  disclosure  policies  to  implement  this  new  FAR  requirement. 


New  FAR  Rules  May 
Improve  DOD 
Oversight  of 
Contractor  Ethics 
Programs  in  Some 
Areas  but  Not  Others 


In  response  to  the  new  FAR  rules,  DOD  has  made  changes  in  two  key 
areas  that  could  improve  oversight  of  contractor  ethics  programs. 
Specifically,  DCAA  revised  its  contract  audit  guidance  to  cover  the  new 
FAR  ethics  requirements.  In  addition,  DOD  IG  established  the  new 
Contractor  Disclosure  Program  to  implement  the  new  mandatory 
disclosure  requirement.  However,  additional  opportunities  exist  to 
improve  DOD’s  oversight  in  two  other  key  areas.  For  example,  in  a  third 
area  DOD  has  not  assigned  responsibility  for  verifying  implementation  of 
contractor  ethics  programs  during  contract  administration.  The  impact  of 
the  FAR  rules  on  oversight  at  this  point  is  negligible  because  the  authority 
for  oversight  is  not  explicit  nor  is  organizational  responsibility  clear.  In  a 
fourth  area — hotline  poster  displays — the  new  FAR  rules  could  have  the 
adverse  consequence  of  reducing  DOD’s  awareness  of  potential  ethics 
violations.  Under  the  rules,  contractors  have  been  exempted  from  the 
requirement  to  display  DOD  hotline  posters  if  they  have  their  own  internal 
hotlines.  This  is  important  because  if  contractor  employees  make  reports 
of  contract-related  fraud,  waste,  and  abuse  to  the  company  hotlines 
instead  of  DOD  hotlines,  DOD  will  be  less  aware  of  potential  problems.  In 
addition,  if  employees  use  contractor  hotlines  instead  of  DOD  hotlines,  the 
employees  do  not  receive  the  same  protections  from  whistleblower  laws. 


DCAA  Developed  New 
Audit  Guidance  on  Internal 
Controls  for  Contractor 
Integrity  and  Ethical 
Values 


Although  DCAA  provides  a  range  of  services  to  contracting  officers  and 
other  DOD  officials,  DCAA’s  primary  function  is  contract  audit  services. 

As  part  of  its  ongoing  oversight  of  contractor  performance  during  the 
contract  administration  phase,  DCAA’s  field  audit  offices  conduct  periodic 
audits  of  contractor  internal  control  systems.  In  carrying  out  such  contract 


To  facilitate  DCAA’s  contract  audit  work,  under  its  decentralized  organizational 
structure,  DCAA  has  field  audit  offices  that  include  resident  offices  at  larger  contractor 
facilities  such  as  those  included  in  this  study. 
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audits,  DCAA  personnel  are  to  follow  the  standards,  policies,  and 
techniques  prescribed  in  the  DCAA  Contract  Audit  Manual  (CAM).^^ 

Senior  headquarters  policy  and  planning  managers  responsible  for  DCAA’s 
auditing  standards  indicated  that  the  impact  of  the  FAR  contractor  ethics 
rules  on  DCAA  contract  audits  has  been  to  improve  audit  guidance.  To 
incorporate  the  December  2008  FAR  ethics  rules  into  its  audits  of 
contractor  controls  for  integrity  and  ethical  values,  in  July  2009  the  agency 
distributed  to  its  field  audit  offices  revisions  of  a  section  of  the  CAM  and 
its  associated  audit  program.^'*  Earlier  in  June  2009,  when  the  Chief, 
Auditing  Standards  Division  updated  us  on  the  status  of  extensive 
revisions  then  under  way  to  improve  the  CAM  audit  guidance,  she 
indicated  that  the  revised  guidance  under  development  would  integrate 
the  new  FAR  standards  into  DCAA’s  auditing  program.  This  was  a  change 
by  DCAA  since  February  2009  when  headquarters  officials  told  us  that 
they  planned  to  make  only  minor  changes.  In  their  view,  this  was  because 
many  of  the  new  FAR  requirements  were  already  in  the  DFARS  section 
upon  which  the  earlier  audit  program  was  based. 

When  we  subsequently  discussed  preliminary  findings  to  that  effect  in 
June  2009,  the  Chief,  Auditing  Standards  Division  told  us  that  the  agency 
had  reconsidered  its  approach  and  was  then  proceeding  to  develop  much 
more  extensive  audit  guidance  revisions  than  what  had  earlier  been 
anticipated.  In  July  2009,  DCAA  provided  us  with  its  revised  audit 
guidance,  including  the  section  of  the  CAM  on  controls  for  contractor 
integrity  and  ethical  values  and  the  associated  audit  program.  DCAA’s  new 
guidance  now  integrates  the  FAR  standards  into  DCAA’s  auditing  program 
for  identifying  potential  internal  control  deficiencies  in  contractors’  ethics 
and  compliance  programs. 


DOD IG  Established 
Contractor  Disclosure 
Program  as  Required  by 
New  FAR  Rule 


The  new  FAR  rule’s  requirement  that  contractors  timely  disclose  credible 
evidence  of  certain  violations  of  federal  criminal  law  or  violations  of  the 
civil  False  Claims  Act  made  it  necessary  in  December  2008  for  DOD  IG  to 
replace  its  Voluntary  Disclosure  Program  with  the  new  Contractor 


Defense  Contract  Audit  Agency,  DCAA  Contract  Audit  Manual,  DCAAM  7640.1  (Nov.  5, 
2008). 

CAM  5-306 — Integrity  and  Ethical  Values,  in  6-300  Section  3 — ^Audit  of  Internal 
Controls — Control  Environment  and  Overall  Accounting  System  Controls. 
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Disclosure  Program.  According  to  the  program’s  manager,  DOD’s  new 
contractor  disclosure  process  provides 

•  contractors  with  Web-based  and  alternative  means  to  report  violations  in 
writing; 

•  coordinated  evaluation  of  criminal,  civil,  and  administrative  actions  with 
Department  of  Justice  (DOJ)  and  DOD  stakeholders  (including  offices  for 
the  Army,  Navy,  and  Air  Force  suspension  and  debarment  authorities  and 
buying  agencies  or  weapon  systems  affected  by  the  disclosure); 

•  a  framework  for  the  government  to  verify  and,  when  appropriate,  act  on 
certain  violations  discovered  through  contractor  self-policing;  and 

•  centralized  management  combined  with  decentralized  execution  and 
faster  turnaround  of  the  investigative  and  prosecution  processes. 

To  implement  the  new  FAR  rules,  DOD  took  immediate  steps — none  of 
which  existed  under  the  Voluntary  Disclosure  Program — to  direct 
reporting  of  all  contractor  disclosures  to  the  Contractor  Disclosure 
Program.  DOD  IG  also  made  early  instructions  available  to  contractors 
on  submitting  information  via  the  Contractor  Disclosure  Program  Web  site 
and,  in  February  2009,  issued  a  contractor’s  guide  to  submitting  a 
disclosure.^®  The  guide  states  that  disclosures  are  made  with  no  advance 
agreement  regarding  possible  DOD  resolution  of  the  matter  and  with  no 
promises  from  DOJ  regarding  potential  civil  or  criminal  actions.  In  the 
event  of  disclosures  of  potential  criminal  liability,  however,  prompt 
disclosure,  full  cooperation,  complete  access  to  necessary  records, 
restitution,  and  adequate  corrective  actions  are  key  indicators  to  DOD  of 
an  attitude  of  contractor  integrity.  DOD  IG  is  also  developing 
instructions — to  be  issued  in  2009 — to  provide  internal  guidance  on 
various  DOD  contractor  oversight  agencies’  roles  and  responsibilities 
under  the  Contractor  Disclosure  Program.  The  instructions  call  on  the 
agencies  to  extensively  coordinate  and  share  management  of  the 
investigation/prosecution  processes. 


For  example,  in  December  2008  the  Under  Secretary  of  Defense  for  AT&L  issued  a 
memorandum  to  provide  DOD  contracting  officers  with  guidance  regarding  implementing 
the  FAR  requirement  for  contractors’  timely  disclosure,  in  writing,  to  the  DOD  IG  office  of 
certain  contract-connected  violations.  The  Under  Secretary’s  memorandum  expressly 
notified  DOD  contracting  officers  of  the  DOD  IG’s  designation  and  address  for  its  new 
Contractor  Disclosure  Program.  AT&L  also  initiated  actions  that  month  to  incorporate  this 
guidance  in  DFARS.  Under  Secretary  of  Defense  (AT&L)  Memorandum,  DOD 
Implementation  of  the  Disclosure  Requirement  Under  FAR  Clause  52.203-13  (Dec.  29, 

2008). 

The  DOD  IG  site  at  http://www.dodig.mil  has  Web-based  disclosures  and  related  guidance 
for  the  Contractor  Disclosure  Program. 
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Before  the  new  program,  the  DOD  Voluntary  Disclosure  Program — 
administered  by  DOD  IG  since  1986 — had  been  largely  ignored  by 
contractors  for  the  past  10  years,  according  to  comments  received  by  the 
FAR  Council  from  DOJ  and  inspectors  general.  The  number  of  contractor 
disclosures  to  the  Voluntary  Disclosure  Program  fell  steeply  over  its  22- 
year  history,  declining  from  about  40  to  60  voluntary  disclosures  accepted 
per  year  in  its  early  years  to  only  9  voluntary  disclosures  accepted  in 
2008.^^  According  to  the  program’s  manager,  in  the  first  7  months  since  the 
mandatory  program’s  start-up  in  December  2008,  DOD  has  received  41 
disclosures  from  contractors.^*^ 

DOD  IG  headquarters  officials  told  us  that  the  agency  will  include 
information  on  the  Contractor  Disclosure  Program — such  as  the  volume, 
nature,  and  disposition  of  active  and  closed  disclosure  cases — as  part  of 
its  semiannual  report  to  Congress.*^® 


New  FAR  Rules  Do  Not 
Call  for  Verifying 
Implementation  of 
Contractor  Ethics 
Programs  during  Contract 
Administration 


The  FAR  does  not  specifically  require  contracting  officials  to  conduct 
oversight  of  contractors’  ethics  programs  during  contract  administration, 
for  example,  verifying  that  the  contractor  has  implemented  the  new 
mandatory  contractor  business  ethics  requirement.  In  contrast,  in  certain 
other  areas  of  the  acquisition  process  the  FAR  provides  guidance  for 
contracting  personnel  regarding  contractor  oversight  that  could  serve  as  a 
model  for  DOD  to  use  in  considering  whether  to  step  up  oversight  of 


This  disclosure  history  does  not  include  an  unknown  number  of  matters  voluntarily 
disclosed  by  contractors  that  DOD  IG  did  not  accept  into  the  Voluntary  Disclosure 
Program.  For  example,  a  disclosure  would  not  be  accepted  into  the  program  if  the 
government  had  prior  knowledge  of  the  matter(s)  disclosed,  such  as  through  government 
audit,  investigation,  contract  administration  efforts,  or  reports  to  the  government  by  third 
parties.  According  to  the  Program  Manager,  Contractor  Disclosure  Program,  total  annual 
voluntary  disclosures  accepted  by  DOD  IG  into  the  program  ranged  eis  high  as  69  cases  in 
1988  to  as  low  as  3  cases  in  2007. 

The  volume  of  disclosures  into  the  Contractor  Disclosure  Program  is  not  strictly 
comparable  to  the  volume  of  voluntauy  disclosures,  according  to  the  program’s  manager. 
Unlike  its  practices  under  the  Voluntary  Disclosure  Program,  DOD  IG  accepts  into  the 
Contractor  Disclosure  Program  all  disclosures  submitted  from  contractors.  This  would 
include  accepting  even  disclosures  of  matterfs)  that  the  government  has  prior  knowledge 
of  through  audit,  investigation,  contract  administration  efforts,  or  reports  by  third  parties. 

As  required  by  the  Inspector  General  Act  of  1978,  as  amended,  DOD  IG  reports 
semiannually  to  Congress.  According  to  DOD  IG,  the  semiannual  report  not  only  provides 
Congress  and  the  taxpayer  with  a  detailed  account  of  what  this  organization  has  done 
during  each  half  of  each  fiscal  year,  it  is  the  embodiment  of  two  important  concepts  upon 
which  the  agency  is  based — accountability  and  transparency. 
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contractor  ethics  programs  during  contract  administration.  This  guidance 
identifies  several  areas  for  which  express  responsibility  is  assigned  to 
contracting  officials  for  verifying  contractor  compliance  with  applicable 
laws  and  regulations.  These  areas  include  activities  related  to 
environmental  practices  and  a  drug-free  workplace.  In  addition,  guidance 
is  provided  to  contracting  personnel  regarding,  as  applicable,  quality 
assurance  and  safety,  both  of  which  are  cited  in  the  FAR  as  general 
standards  for  determining  whether  a  prospective  contractor  is  responsible, 
just  as  having  a  satisfactory  record  of  integrity  and  business  ethics  is  a 
responsibility  standard.^®  Such  oversight  during  contract  formation  and 
administration  is  done,  in  part,  to  avoid  any  adverse  impacts  on  contract 
performance  or  cost  after  contract  award. 

As  DOD’s  lead  contract  administration  agency,  DCMA  provides  a  range  of 
services  to  contracting  officers  and  other  DOD  officials  after  contract 
award.  If  assigned  to  do  so  by  a  contracting  officer  as  part  of  DCMA’s 
contract  administration  responsibilities  after  contract  award,  DCMA 
monitors  contractor  performance  and  management  systems  to  ensure  that 
cost,  quality,  and  schedule  are  in  compliance  with  the  terms  and 
conditions  of  the  contracts.®^  DCMA’s  monitoring  is  primarily  performed 
by  an  administrative  contracting  officer  (ACO)  located  in  the  field  at  a 
contract  administration  office  (CAO)  who  is  assigned  to  administer  the 


FAR  subpart  9.1. 

As  of  December  2008,  DCMA  reports  managing  291,000  prime  contracts  valued  at 
$950  billion.  However,  according  to  DCMA  headquarters  officials,  most  contracts  DCMA 
manages  pertain  to  major  weapon  system  procurements.  Not  generally  covered  by  DCMA’s 
contract  management  services  are  most  of  DOD’s  services  contractors,  other  than  those  on 
a  limited  number  of  services  contracts  related  to  DOD  weapon  systems  maintenance  and 
the  Army’s  Logistics  Civil  Augmentation  Program  contract  to  support  worldwide 
contingency  operations. 

After  contract  award,  the  procuring  contracting  officer  at  the  buying  office  may  or  may 
not  assign  contract  administration  (i.e.,  oversight)  responsibility  to  a  separate  office.  If  the 
contracting  officer  does  not  assign  this  responsibility  to  a  separate  office,  contract 
administration  remains  the  contracting  officer’s  responsibility.  Under  the  FAR,  when  a 
contract  is  assigned  for  administration,  the  contracting  officer  normally  delegates  portions 
of  a  list  of  70  specific  contract  administration  functions  to  a  designated  contract 
administration  office  (CAO).  FAR  Subpart  42.3 — Contract  Administration  Office  Functions. 
Under  DFARS,  some  additional  CAO  functions  are  identified  for  the  review  and  evaluation 
of  certain  other  contractor  cost  estimating  and  accounting  systems.  DFARS  Subpart 
242.3 — Contract  Administration  Office  Functions. 
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contract  with  assistance  from  engineers  and  other  specialists  at  DCMA.^^ 
To  specifically  combat  procurement  fraud  with  a  strong  focus  on  assisting 
CAOs  through  coordination  of  remedies  and  process  improvement,  DCMA 
also  has  a  Contract  Integrity  Center — operated  by  its  Office  of  General 
Counsel — ^with  attorneys  geographically  dispersed  across  the  United 
States.  According  to  DCMA,  these  contracting  integrity  attorneys  work 
full-time  on  the  prevention,  detection,  investigation,  and  prosecution  of 
allegations  of  procurement  fraud  and  other  misconduct. 

Despite  DCMA  having  the  important  role  of  performing  contract 
administration  services  for  many  of  DOD’s  contracts  after  award,  the 
impact  of  the  new  FAR  rules  on  changing  the  CAO  function  to  include 
some  degree  of  oversight  to  verify  implementation  of  contractor  ethics 
programs  has  been  negligible.  For  example,  most  of  the  nine  CAO  staff  we 
talked  to  who  provide  ongoing  contract  administration  and  oversight  of 
seven  major  DOD  contractors  told  us  that  they  may  receive  information 
from  the  contractors  or  from  DCAA  on  the  status  of  contractors’  ethics 
programs.  In  addition,  they  monitor  contractor  ethics  program  actions  to 
correct  internal  control  deficiencies  for  integrity  and  ethical  values  in 
response  to  deficiencies  discovered  during  DCAA  audits.  However,  other 
than  reacting  as  information  comes  to  them  from  the  contractor  and 
DCAA,  the  CAO  staff  indicated  that  they  were  not  planning  to  routinely 
verify  contractor  ethics  program  efforts.  Some  of  these  staff  indicated  that 
they  were  willing  to  monitor  contractors’  ethics  programs  but  noted  that  it 
is  currently  not  required  by  the  FAR.  Some  staff  indicated  that  if  such  a 
task  was  required,  criteria  or  instructions  on  what  to  look  for  would  be 
needed.  However,  the  new  FAR  rules  are  silent  with  regard  to  contracting 
officer  review  or  standards  for  examining  contractor  ethics  programs 
during  contract  administration.  As  such,  without  further  guidance,  CAO 
staff  will  continue  as  before  the  new  FAR  rules  were  implemented  with 
limited  oversight  of  contractors’  ethics  programs. 


^  On  a  given  contract,  there  may  be  two  types  of  contracting  officers:  (1)  the  procuring 
contracting  officer  at  the  buying  office,  who  awards  and  signs  the  contract,  and  (2)  if 
assigned  by  the  procuring  contracting  officer  after  contract  award,  the  AGO  at  the  CAO 
who  administers  the  contract,  which  includes  monitoring  contractor  performance.  To 
facilitate  its  contract  administration  work,  under  its  decentralized  organizational  structure, 
DCMA’s  divisions  have  47  field  CAOs  and  assign  “corporate”  administrative  contracting 
officers  to  provide  oversight  at  larger  contractor  facilities,  such  as  those  included  in  this 
study.  As  of  December  2008,  DCMA  has  about  10,000  civilian  and  military  staff  overseeing 
almost  19,000  contractors. 
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Before  the  FAR  requirements  were  finalized  in  2008 — and  Congress 
mandated  that  we  report  on  the  extent  to  which  DOD  monitors  or 
approves  defense  contractors’  ethics  programs — ^we  previously 
recommended  in  2005  that  DOD  needs  to  obtain  more  knowledge  of 
contractors’  standards  of  conduct  efforts  and  that  enhanced  awareness  of 
contractor  ethics  programs  would  enable  DOD  to  assess  whether  the 
public  trust  is  protected.^  We  recommended  that  DOD  take  actions  to 
improve  its  knowledge  and  oversight  of  contractors’  ethics  programs.  DOD 
commented  that  the  recommendation  was  currently  implemented  when 
contracting  officers  make,  prior  to  awarding  a  contract,  an  affirmative 
determination  of  responsibility,  which  included  consideration  of  the 
potential  contractor’s  business  practices  and  the  potential  contractor’s 
integrity.  As  we  then  indicated  in  response  to  DOD’s  comment,  more  could 
be  done  through  assessments  of  contractor  ethics  programs  to  enhance 
contracting  officers’  ability  to  make  such  determinations. 

Four  years  later,  with  the  FAR  rules  having  been  significantly  expanded, 
DOD  has  not  determined  what  if  any  changes  are  needed  to  its  oversight  of 
contractor  ethics  programs  during  contract  administration.  The  FAR 
Council  disposition  in  2007  of  public  comments  received  from  the  initial 
FAR  rulemaking  process  provides  some  insight  into  what  contractors 
might  expect  of  contracting  officials’  oversight  of  the  new  ethics  program 
requirements.  For  example,  the  FAR  Council  commented  that  review  of 
contractors’  compliance  would  be  incorporated  into  normal  contract 
administration  on  a  discretionary  basis,  but  provided  no  description  on 
how  responsibihty  for  that  discretionary  duty  would  be  assigned  or 
exercised.^®  If  such  a  review  were  to  be  required  by  DOD  guidance,  it 
could  use  the  FAR’s  framework  for  contractor  ethics  program  standards  to 
begin  to  provide  a  basis  for  DCMA  or  other  contracting  officials  to  verify 
that  a  contractor  has  established  the  type  of  internal  ethics  and 
compliance  program  to  be  expected.  This,  in  turn,  would  provide  some 
assurance  that  contractors  are  following  ethics  programs  as  expected  by 
the  FAR  Council  to  help  prevent,  detect,  and  timely  disclose  contract- 
related  fraud,  waste,  and  abuse. 


GAO-05-341. 

As  part  of  the  rulemaking  process,  several  respondents  questioned  how  the  contracting 
officer  would  verify  compliance  with  the  requirements.  The  FAR  Council  commented  that 
the  contracting  officer  is  not  required  to  verify  compliance,  but  may  inquire  at  his  or  her 
discretion  as  part  of  contract  administrative  duties.  72  Fed.  Reg.  66878  (Nov.  23,  2007). 
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Beyond  the  issue  of  authority,  there  is  no  consensus  among  DOD 
contractor  oversight  officials  on  where  organizationally  such 
responsibility  for  verifying  the  implementation  of  the  new  FAR  ethics 
program  requirements  during  contract  administration  would  be  assigned. 
Some  of  DCMA’s  CAO  staff  that  we  spoke  with  at  several  of  DOD’s  largest 
contractor  facilities  said  that  oversight  of  contractor  ethics  program 
compliance  would  fit  into  their  contract  administration  area  of 
responsibility.  Other  contractor  oversight  officials  at  DOD  IG,  DCAA,  and 
the  Office  for  the  Under  Secretary  of  Defense  for  AT&L  told  us  that 
verifying  or  monitoring  DOD  contractor  ethics  programs  would  logically 
fit  with  DCMA’s  contract  administration  services. 

DCMA  headquarters  officials,  however,  stated  that  it  is  not  their  agency’s 
functional  responsibility  to  verify  compliance  with  the  new  contractor 
ethics  requirements.  One  senior  DCMA  headquarters  official  indicated  that 
it  would  be  better  to  assign  responsibility  for  this  function  to  DCAA’s 
contract  audit  services  that  assess  the  adequacy  of  contractor  internal 
controls  for  integrity  and  ethical  values.^®  In  addition,  assigning  this 
function  to  DCMA  alone  would  leave  some  defense  contractors 
unaddressed  because  DCMA  is  not  delegated  management  responsibility 
for  all  defense  contracts,  according  to  its  headquarters  officials.  Rather, 
CAO  staff  at  DCMA’s  field  locations  oversee  just  those  contracts  and 
perform  contract  administration  as  assigned  to  them  by  procuring 
contracting  officers  at  DOD’s  buying  offices.  Thus,  for  many  of  DOD’s 
contractors,  the  contract  administration  function  is  retained  by  the 
procuring  contracting  officer.  As  a  result,  other  contracting  officials  across 
DOD  procuring  offices  would  need  to  examine  any  contractors  not 
covered  by  DCMA  CAO  staff. 


^  Under  the  FAR,  however,  DCAA’s  role  is  advisory,  which  means  it  has  less  authority  than 
DCMA’s  CAOs  have  to  require  contractor  action  to  correct  deficiencies  DCMA  identifies 
through  contract  administration. 

According  to  DCMA  headquarters’  officials,  DCMA’s  contract  administrative  functions  do 
not  address  most  of  DOD’s  services  contractors. 
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Not  Requiring  Display  of 
DOD  Hotline  Posters 
Could  Delay  or  Lessen 
DOD’s  Awareness  of 
Problems  and  Use  of 
Whistleblower  Protections 


Under  the  FAR  rule  effective  in  December  2007,  defense  contractors  are 
not  required  to  display  DOD  IG’s  fraud  hotline  posters  if  the  contractors’ 
ethics  and  compliance  programs  include  reporting  mechanisms  such  as 
their  own  hotline  posters.  According  to  a  FAR  Council  response  to  public 
comments  in  finalizing  the  agency  hotline  display  rule  in  2007,  the 
exemption  was  to  mirror  earlier  DFARS  guidance,  which  permitted 
contractors  to  post  their  own  hotline  posters,  in  lieu  of  DOD  hotline 
posters,  to  provide  an  outlet  for  employees  to  raise  issues  of  concern.^'* 
This  exemption  has  two  potential  adverse  consequences  for  DOD 
oversight  of  defense  contractors:  lessening  DOD’s  awareness  of  problems 
and  diminishing  contractor  employee  awareness  of  whistleblower 
protections. 


The  display  of  the  standard  hotline  posters  available  to  contractors  from 
DOD  IG,  shown  in  figure  1,  at  contractor  work  sites  is  part  of  DOD’s 
efforts  to  fight  procurement  and  other  types  of  fraud,  waste,  and  abuse. 


Under  FAR  52.203-14 — Display  of  Hotline  Poster(s),  a  contractor  is  exempt  from  the 
required  display  of  DOD  IG’s  fraud  hotline  poster  if  the  contractor  has  an  ethics  and 
compliance  program  that  includes  a  reporting  mechanism  such  as  a  hotline  poster. 
According  to  the  FAR  Council,  unless  an  agency’s  inspector  general  requires  specific 
requirements  and  information  for  posters,  there  is  no  need  to  have  multiple  agency  posters 
if  a  company  has  its  own  internal  reporting  mechanism. 

DFARS  Subpart  203.70 — Contractor  Standards  of  Conduct,  guidance  removed  by  DOD  on 
August  12,  2008.  73  Fed.  Reg.  46815  (Aug.  12,  2008). 
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Figure  1 :  DOD  Hotline  Posters  Available  for  Contractor  Display 


Source:  DOD  IG. 


In  fiscal  year  2008  alone,  DOD’s  hotline  received  nearly  14,000  contacts 
resulting  in  2,000  cases  referred  for  investigation.  However,  because  the 
FAR  rule  exempts  contractors  whose  ethics  programs  include  their  own 
hotlines,  and  if  more  contractors  opt  not  to  display  DOD’s  hotline  posters, 
there  is  a  risk  that  defense  contractor  employees  will  be  unaware  and  not 
avail  themselves  of  DOD’s  hotline.  According  to  our  ethics  program 
survey,  55  of  the  57  contractors  report  having  one  or  more  reporting 
mechanisms,  such  as  a  hotline  for  employees  to  report  known  or 
suspected  conduct  that  violates  ethics  standards  or  contract  requirements. 

The  DOD  hotline  poster’s  absence  from  contractor  work  sites  could  also 
jeopardize  use  of  whistleblower  protections  for  contractor  employees  put 
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in  place  by  DOD  in  response  to  legislation  separate  from  the  development 
of  the  FAR’s  contractor  ethics  program  requirements/"  Under  this 
legislation,  federal  protections  were  strengthened  for  contractor 
employees  against  employer  reprisals  for  blowing  the  whistle  to 
government  entities  (such  as  DOD  IG  through  its  fraud  hotline)  on 
suspected  gross  mismanagement  of  or  illegal  activities  on  a  DOD  contract. 
The  contractor  internal  reporting  mechanisms,  such  as  hotline  posters 
required  separately  under  the  new  FAR  rules,  do  not  provide  contractor 
employees  with  the  type  of  whistleblower  protections  that  disclosure  to 
DOD  IG  or  to  other  DOD  entities  offers.''^ 

Although  DFARS,  since  January  2009,  requires  contractors  to  inform  their 
employees  in  writing  of  these  federal  whistleblower  rights  and 
protections,''^  without  display  of  DOD’s  hotline  poster  in  a  contractor  work 
site,  contractor  employees  could  unwittingly  disclose  information  to  the 
company’s  internal  hotline,  where  they  would  not  have  federal  protections 
in  the  event  of  employer  reprisals.  To  facilitate  contractor  employee 
whistleblower  protections,  senior  DOD  IG  headquarters  officials 
responsible  for  investigations  and  policy  agreed  that  it  might  be  necessary 
to  modify  DOD  hotline  posters  for  display  at  contractor  work  sites  to 
inform  contractor  employees  that  their  federal  whistleblower  protections 
are  limited  to  disclosures  to  government  entities  only. 

According  to  FAR  Council  responses  to  public  comments  received  while 
finalizing  the  hotline  display  rule,  it  is  the  responsibility  of  the  agency 
inspector  general  to  determine  the  need  for,  and  the  contents  of,  the  fraud 
hotline  poster.  Given  the  magnitude  of  DOD’s  contract  dollars  spent  each 
year,  with  tens  of  thousands  of  contractors  and  ongoing  efforts  by  DOD 
through  its  Panel  on  Contracting  Integrity  to  reduce  vulnerabilities  to 
procurement  fraud,  we  asked  DOD  IG,  DCAA,  suspension  and  debarment. 


Duncan  Hunter  National  Defense  Authorization  Act  for  Fiscal  Year  2009,  Pub.  L.  No.  110- 
417  §  842  (2008). 

Under  DOD  IG  hotline  policy,  to  reduce  fear  of  potential  employer  reprisal  and 
encourage  hotline  disclosures,  the  identity  of  contractor  employees  who  report  through  the 
DOD  hotline  is  not  released  without  employee  permission.  DOD  IG  Mission  Briefing 
(Feb.  24,  2009). 

DFARS  Subpart  203.9. 
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and  AT&L  contractor  oversight  officials  for  their  views. Specifically,  we 
asked  about  the  risk  of  defense  contractors  not  displaying  DOD  hotline 
posters  and  whether  the  hotline  poster’s  absence  in  workplaces  where 
DOD  contracts  are  performed  might  impinge  on  DOD’s  ability  to  timely 
address  contractor  violations.  Several  of  the  DOD  oversight  officials  were 
not  aware  of  the  FAR’s  exemption  regarding  display  of  the  DOD  hotline 
posters  until  we  told  them. 

Once  informed,  some  of  these  DOD  officials  expressed  concern  that  the 
hotline  poster’s  absence  was  not  in  the  best  interest  of  reducing  DOD’s 
vulnerability  to  procurement  fraud.  DOD  IG  officials  agreed  that  changing 
DFARS  to  require  all  defense  contractors  to  display  the  DOD  hotline 
poster  should  occur.  Nearly  all  of  the  57  contractors  we  surveyed  appear 
positioned  to  detect  problems  because  they  report  having  mechanisms 
such  as  hotlines  for  employees  to  report  problems.  However,  the  DOD  IG 
team  leader  for  military  reprisal  investigations  expressed  concern  that 
contractor  employees  may  be  uncomfortable  reporting  to  their  companies’ 
internal  hotlines,  an  indication  that  relying  only  on  contractor  reporting 
mechanisms  could  also  result  in  DOD  not  finding  out  about  the  problems 
at  all.  Moreover,  relying  on  contractor  mechanisms  could  also  delay  DOD’s 
awareness  of  such  problems  and  its  efforts  to  verify  and  act  on  suspected 
violations.  For  example,  under  the  new  FAR  rules,  the  length  of  time  it 
takes  a  contractor  to  determine  if  there  is  credible  evidence  of  a  violation 
subject  to  mandatory  disclosure  requirements  could  affect  DOD’s 
awareness  of  a  problem.'*^  With  the  DOD  hotline,  DOD  has  immediate 
awareness  of  potential  violations  from  contractor  employee  calls.  ’While 
there  might  be  practical  reasons  for  continuing  to  exempt  some  defense 
contractors  with  their  own  hotlines  from  displaying  DOD’s  hotline  poster. 


In  February  2007,  the  Under  Secretary  of  Defense  for  AT&L  established  the  Panel  on 
Contracting  Integrity,  as  required  by  section  813  of  the  Defense  Authorization  Act  for  Fiscal 
Year  2007.  The  panel,  whose  executive  director  is  the  Director,  Defense  Procurement  and 
Acquisition  Policy  and  Strategic  Sourcing,  includes  more  than  20  senior-level  procurement 
executives,  inspectors  general,  and  other  representatives  from  across  DOD.  As  required  by 
the  act,  DOD  has  submitted  two  annual  reports  to  Congress  since  December  2007  on  the 
panel’s  findings  and  recommendations  to  foster  and  monitor  contracting  integrity  across 
the  department.  John  Warner  National  Defense  Authorization  Act  for  Fiscal  Year  2007, 

Pub.  L.  No.  109-364  §  813  (2006). 

Subsequent  to  detecting  problems  through  such  internal  hotlines,  in  accordance  with  the 
new  FAR  rules,  contractors  are  to  determine  whether  there  is  credible  evidence  that 
certain  contract-related  violations  have  occurred.  If  the  contractor  determines  there  is 
credible  evidence,  the  FAR  then  requires  the  contractor’s  timely  disclosure  of  violations  to 
the  agency  inspector  general.  FAR  52.203-13. 
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such  as  avoiding  the  confusion  or  duplication  that  could  occur  with  too 
many  hotline  posters  on  display  in  one  place,  senior  contract  policy 
officials  in  the  Office  of  the  Under  Secretary  of  Defense  for  AT&L  believe 
that  further  study  is  warranted  of  possible  changes  in  DFARS  to  more  fully 
protect  defense  contracting  integrity/'^ 


Conclusions 


The  FAR  requirements  provide  new  direction  for  defense  contractor  ethics 
programs  and  present  DOD  opportunities  to  improve  its  oversight  of  these 
programs.  The  new  rules  seek  to  promote  organizational  cultures  that 
encourage  ethical  behavior  as  well  as  promote  compliance  with  the  law. 
Our  survey  completed  in  2009  shows  that  nearly  all  of  the  57  major 
defense  contractors  reviewed  included  many  of  the  ethics  program 
practices  before  the  FAR  rules  were  finalized  consistent  with  the 
standards  later  required  for  compliance.  DOD,  in  turn,  is  making  positive 
changes  to  address  some  of  the  new  FAR  requirements. 

However,  additional  opportunities  exist  to  improve  DOD’s  oversight  in 
two  key  areas.  The  first  is  in  the  area  of  verifying  the  existence  of 
contractor  ethics  programs  after  contract  award  as  part  of  contracting 
officers’  contract  administration  responsibility.  The  need  for  new 
oversight  attention  and  guidance  across  DOD  in  the  area  of  contract 
administration  has  not  been  clearly  identified  or  determined.  Such 
additional  oversight  of  contractor  ethics  programs  during  contract 
administration  could  help  ensure  that  contractor  ethics  programs  are  in 
place  as  intended. 

The  second  is  in  the  area  of  DOD’s  hotline  program,  for  improved 
oversight  for  potential  contract-related  fraud,  waste,  and  abuse.  The  new 
FAR  contractor  ethics  rules  have  the  potential  to  make  the  hotline 
program  less  effective  by  ultimately  reducing  contractor  exposure  to  DOD 
hotline  posters  and  diminishing  the  means  by  which  fraud,  waste,  and 
abuse  can  be  reported  under  the  protection  of  federal  whistleblower  laws. 
Nearly  all  of  the  major  contractors  surveyed  have  in-house  ethics  and 
compliance  programs  that  exempt  them  from  displaying  the  DOD  posters. 
It  is  conceivable  that  virtually  no  major  contractor  would  be  required  to 
display  the  DOD  hotline  posters.  Contractor  employees  might  be  reluctant 


According  to  senior  contract  policy  officials  in  the  Office  of  the  Under  Secretary  of 
Defense  for  AT&L,  DOD’s  Panel  on  Contracting  Integrity  could  take  up  consideration  of 
this  and  related  matters  concerning  DOD  contracting  oversight  that  are  affected  by  FAR 
changes  requiring  contractor  ethics  programs. 
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to  report  violations  to  an  in-house  hotline  that  did  not  provide  federal 
protection  against  company  retaliation.  However,  employees  do  have  such 
protection  when  reporting  directly  to  the  DOD  hothne. 

Recommendations  for 
Executive  Action 

• 

• 

We  are  recommending  four  actions  aimed  at  improving  DOD’s  oversight  of 
defense  contractors’  ethics  programs.  First,  to  strengthen  oversight  during 
contract  administration,  we  recommend  that  the  Secretary  of  Defense 
direct  the  Under  Secretary  of  Defense  for  AT&L  to  determine  what  if  any 
new  DFARS  or  other  guidance  is  needed  to  clarify  functional 
responsibilities  of  DCMA  and  other  contracting  officials  during  contract 
administration  for  verifying  the  implementation  of  contractor  ethics 
programs  as  required  under  the  FAR  ethics  rules. 

To  avoid  delaying  or  lessening  DOD  IG  awareness  of  contract-related 
problems  and  diminishing  of  whistleblower  protections  for  contractor 
employees,  we  recommend  that  the  Inspector  General  for  the  Department 
of  Defense,  in  accordance  with  the  FAR,  take  the  following  two  actions: 

Determine  the  need  for  defense  contractors’  display  of  DOD  IG’s  fraud 
hotline  poster,  including  directing  a  contractor  to  display  the  DOD  IG 
hotline  poster  in  common  work  areas  for  performance  of  DOD  contracts. 
Determine  the  contents  of  the  DOD  IG’s  fraud  hotline  poster  for  display  by 
defense  contractors,  including  revising  the  poster  to  inform  contractor 
employees  of  their  federal  whistleblower  protections. 

Fourth,  if  the  need  for  hotline  poster  display  is  determined  by  the 

Inspector  General,  we  recommend  that  the  Secretary  of  Defense  direct  the 
Under  Secretary  of  Defense  for  AT&L  to  propose  revisions  to  DFARS  to 
include  policy  requiring  a  contract  clause  directing  a  contractor  to  display 
the  DOD  IG  hotline  poster  in  common  work  areas  for  performance  of  DOD 
contracts.  DFARS  policy  should  require  a  defense  contractor’s  display  of 
the  DOD  IG  fraud  hotline  poster  irrespective  of  whether  that  contractor 
has  its  own  internal  mechanism,  such  as  a  hotline  for  employees  to  report 
contract-related  improprieties. 

Agency  Comments 

We  provided  a  draft  of  this  report  and  the  e-supplement  that  accompanies 
it  to  DOD  for  comment.^®  The  Office  of  the  Under  Secretary  of  Defense  for 

The  e-supplement,  which  presents  results  from  the  survey  of  contractor  ethics  programs, 
can  be  found  on  our  Web  site  at  http://redesign-www.gao.gov/special.pubs/gao-09- 
646sp/index.html. 
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AT&L’s  Director,  Defense  Procurement  and  Acquisition  Policy,  wrote  that 
DOD  concurs  with  the  first  three  recommendations.  For  example, 
according  to  the  Director,  the  first  recommendation  will  be  referred  to  the 
Defense  Acquisition  Regulation  (DAR)  Council  to  establish  a  DFARS  case 
to  determine  whether  additional  guidance  is  needed  to  clarify  the 
administrative  contracting  officer’s  functional  responsibilities. 

Regarding  the  last  recommendation,  the  Director  wrote  that  DOD  partially 
concurs  because  it  is  not  necessary  (as  we  recommended)  for  the  Panel  on 
Contracting  Integrity  to  propose  the  revisions.  However,  in  response  to 
this  recommendation,  the  Director  will  submit  the  proposed  revisions  to 
DFARS  via  memorandum  to  the  DAR  Council.  Since  DOD’s  comment 
concurs  with  the  substance  of  the  recommendation,  we  revised  it  to  better 
align  with  DOD’s  preferred  method  for  implementation.  DOD’s  comments 
are  reprinted  in  appendix  11. 


We  are  sending  copies  of  this  report  to  the  Secretary  of  Defense,  the  DOD 
Inspector  General,  the  Director  of  the  Office  of  Management  and  Budget, 
the  major  defense  contractors  identified  in  this  report,  and  other 
interested  parties.  The  report  also  is  available  at  no  charge  on  the  GAO 
Web  site  at  http://www.gao.gov. 

If  you  or  your  staff  have  any  questions  about  this  report,  please  contact  me 
at  (202)  512-4841  or  needhamjkl@gao.gov.  Contact  points  for  our  Offices 
of  Congressional  Relations  and  Public  Affairs  may  be  found  on  the  last 
page  of  this  report.  GAO  staff  who  made  major  contributions  to  this  report 
are  listed  in  appendix  IV. 


John  K.  Needham 

Director,  Acquisition  and  Sourcing  Management 
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List  of  Congressional  Committees 

The  Honorable  Carl  Levin 
Chairman 

The  Honorable  John  McCain 
Ranking  Member 
Committee  on  Armed  Services 
United  States  Senate 

The  Honorable  Ike  Skelton 
Chairman 

The  Honorable  Howard  P.  “Buck”  McKeon 
Ranking  Member 
Committee  on  Armed  Services 
House  of  Representatives 
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Congress  included  a  provision  in  the  National  Defense  Authorization  Act 
for  Fiscal  Year  2008  requiring  us  to  report  on  the  internal  ethics  programs 
of  major  defense  contractors/  In  January  2009,  we  briefed  the  Senate  and 
House  Armed  Services  Committees  on  the  preliminary  results  regarding 
the  reporting  requirements  specified  in  the  act.  After  this  congressional 
mandate,  revisions  to  the  Federal  Acquisition  Regulation  (FAR)  to  require 
internal  ethics  programs  of  contractors  were  finalized.  As  shown  in  table 
lO’s  side-by-side  comparison,  ethics  program  elements  identified  by 
Congress  for  inclusion  in  this  report  are  very  similar  to  the  contractor 
ethics  program  elements  now  required  by  the  FAR. 


Table  10:  Comparison  of  Ethics  Program  Elements  in  Congressional  Mandate  and 
FAR  Requirements 

Contractor  internal  ethics  program  elements 

Congressional 

mandate 

FAR 

requirements 

Written  code  of  business  ethics  and  conduct 

X 

internai  mechanisms,  such  as  hotiines,  for  reporting 
misconduct 

X 

X 

Notification  to  empioyees  of  externai  mechanisms, 
such  as  the  Department  of  Defense  (DOD)  inspector 
Generai  (iG)  hotiine,  for  reporting  misconduct 

X 

X 

Notification  to  empioyees  of  their  right  to  be  free  from 
reprisai  for  disciosing  a  substantiai  vioiation  of  iaw 
related  to  a  contract 

X 

Ethics  training  programs 

X 

X 

internai  audit  or  review  programs 

X 

X 

Requirements  for  seif-reporting  vioiations  to 
government  officiais 

X 

X 

Discipiinary  action 

X 

X 

Appropriate  management  oversight 

X 

X 

Sources:  Section  848  of  the  National  Defense  Authorization  Act  for  Fiscal  Year  2008  and  FAR  Subparts  3.10,  Clauses  52.203-13,  and 
52203-14  (information);  GAO  (analysis  and  presentation). 


“We  also  reported  on  contractor  employee  whistleblower  protections,  which  were  addressed  In  §  846 
{b){2){C)  of  the  National  Defense  Authorization  Act  for  Fiscal  Y  ear  2008,  Pub.  L.  No.  110-181,  and  § 
842  (a)  of  the  National  Defense  Authorization  Act  for  Fiscal  Year  2009,  Pub.  L.  No.  110-417  (2008). 


Given  the  similarity  between  some  of  the  ethics  program  elements  in  our 
congressional  mandate  and  the  current  FAR  requirements,  our  audit  and 
reporting  objectives  were  to  (1)  describe  the  extent  to  which  contractors 


^  Section  848(a)  required  us  to  report  by  January  28,  2009,  on  the  internal  ethics  programs 
of  major  defense  contractors.  Pub.  L.  No.  110-181  §  848  (2008). 
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had  ethics  programs  before  the  finalization  of  the  FAR  rules  that  included 
practices  consistent  with  standards  now  required  by  the  FAR  and 
(2)  assess  the  impact  the  new  FAR  rules  have  on  DOD  oversight  of 
contractor  ethics  programs. 

Section  848  defined  a  major  defense  contractor  as  any  company  awarded 
contracts  by  DOD  during  fiscal  year  2006  in  amounts  totaling  more  than 
$500  million.  To  identify  those  contractors,  we  analyzed  data  on  the  values 
of  contracts  awarded  to  all  companies  from  DOD’s  Statistical  Information 
Analysis  Division.  We  initially  identified  65  contractors,  but  we  eliminated 
six  companies  that  merged  or  were  joint  ventures,  as  well  as  two  foreign 
government  entities  from  our  review.  Based  on  our  review  of  DOD’s  data, 
we  found  that  the  data  were  sufficiently  reliable  for  the  purpose  of 
identifying  which  contractors  to  include  in  this  report.  As  a  result,  we 
identified  the  57  contractors  meeting  the  major  defense  contractor  criteria 
to  include  in  our  review.  As  shown  in  table  11,  which  ranks  the  57  major 
defense  contractors  by  the  value  of  their  fiscal  year  2006  DOD  contract 
awards,  these  companies  accounted  for  more  than  half  of  DOD’s  total 
contract  awards  in  2006 — $164.5  billion  of  the  total  $295  billion. 


Table  11 :  Contractors  Reviewed  by  GAO,  by  Value  of  Total  Contract  Awards  from 
DOD  in  Fiscal  Year  2006 

Dollars  In  millions 

Value  of  DOD 

Contractor  contract  awards 

Contractor 

Value  of  DOD 
contract  awards 

Lockheed  Martin 
Corporation 

$26,620 

Shell  Oil  Company 

$1,151 

Boeing  Company 

21,721 

AlllantTechsystems, 

Inc. 

1,128 

Northrop  G  rumman 
Corporation 

16,627 

Oshkosh  T ruck 

Company 

941 

General  Dynamics 
Corporation 

11,942 

Rockwell  Collins,  Inc. 

824 

Raytheon  Company 

10,069 

Korea  Agricultural 
Cooperative 

761 

BAE  Systems  PLC 

6,192 

DRS  Technologies 

730 

KBR,  Inc. 

6,060 

Phillips  &J  ordon,  Inc. 

705 

L-3  Communications 
Holding,  Inc. 

5,197 

CACI  International,  Inc. 

681 

United  Technologies 
Corporation 

4,453 

General  Atomic 
Technologies  Company 

670 

Page  35 


GAO-09-591  DOD  Contractor  Ethics  Programs 


Appendix  I:  Scope  and  Methodology 


Dollars  In  millions 

Contractor 

Value  of  DOD 
contract  awards 

Contractor 

Value  of  DOD 
contract  awards 

Science  Applications 
International 
Corporation  (SAIC) 

3,211 

McKesson  Corporation 

670 

Computer  Sciences 
Corporation  (CSC) 

2,884 

Valero  Energy 
Corporation 

661 

Humana,  Inc. 

2,642 

Thales 

657 

ITT  Corporation 

2,522 

Aerospace  Corporation 

654 

General  Electric 
Company 

2,328 

Mitre  Corporation 

652 

Health  Net,  Inc. 

2,119 

Massachusetts  Institute 
of  Technology 

640 

TrIwest  Heathcare 
Alliance  Company 

2,022 

Dell,  Inc. 

636 

Electronic  Data 
Systems  Corporation 

2,008 

Cardinal  Health,  Inc. 

635 

AM  General,  LLC 

1,944 

Syracuse  Research 
Corporation 

613 

Agility  Logistics 

1,838 

Chugach  Alaska 
Corporation 

593 

Honeywell 
International,  Inc. 

1,679 

Refinery  Associates  of 
Texas 

577 

Textron,  Inc. 

1,369 

Environmental 

Chemical  Corporation 

570 

URS  Corporation 

1,369 

Parsons  Corporation 

526 

Amerlsourcebergen 

Corporation 

1,346 

J  ohns  Hopkins 

University 

525 

Harris  Corporation 

1,339 

Battelle  Memorial 
Institute 

519 

FedEx  Corporation 

1,303 

Shaw  Group,  Inc. 

519 

Bechtel  Group,  Inc. 

1,264 

Maersk  Line  Ltd. 

516 

Booz  Allen  Hamilton, 
Inc. 

1,245 

J  acobs  Engineering 
Group,  Inc. 

505 

BP  America,  Inc. 

1,199 

Kraft  Foods,  Inc. 

501 

Exxon  Mobil 
Corporation 

1,176 

Total  DOD  contract  awards  to  these  57  contractors  in  2006 

$164,448 

Total  DOD  contract  awards  to  all  contractors  in  2006 

$294,976 

Sources:  GAO  (analysis):  DOD  (data). 

Note:  The  dollar  value  of  DOD  contract  awards  In  2006  for  each  contractor  was  rounded  to  the 
nearest  million. 
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We  conducted  this  performance  audit  from  May  2008  through  August  2009 
in  accordance  with  generally  accepted  government  auditing  standards. 
Those  standards  require  that  we  plan  and  perform  the  audit  to  obtain 
sufficient,  appropriate  evidence  to  provide  a  reasonable  basis  for  our 
findings  and  conclusions  based  on  our  audit  objectives.  We  believe  that 
the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives. 

The  scope  and  methods  we  used  to  perform  this  audit  are  described  in 
greater  detail  in  the  remainder  of  this  appendix.^ 


First  Audit  Objective  To  determine  the  extent  to  which  57  major  defense  contractors  included  in 

our  review  have  internal  ethics  programs  that  include  certain  practices 
consistent  with  standards  now  required  by  the  FAR,  we  designed  and 
conducted  a  Web-based  survey  of  all  57  contractors.  To  gain  an  initial 
understanding  of  the  variety  and  scope  of  information  reasonably  available 
on  the  range  of  practices  used  in  relation  to  internal  ethics  programs,  we 
reviewed  chapter  8  (Sentencing  of  Organizations)  of  the  2007  Federal 
Sentencing  Guidelines  Manual  and  government  contract  management 
publications  for  information  to  describe  the  FAR  contractor  ethics 
program  requirements.  We  also  interviewed  officials  from  government  and 
public  entities  with  knowledge  in  this  area,  including  the  Defense  Industry 
Initiative  on  Business  Ethics  and  Conduct,  the  Ethics  Resource  Center, 
DOD,  and  the  Department  of  Justice’s  National  Procurement  Fraud  Task 
Force. 

To  conduct  this  survey,  we  pretested  it  in  July  2008  with  Lockheed  Martin 
Corporation,  Electronic  Data  Systems  Corporation,  Agility  Logistics,  and 
Mitre  Corporation  to  determine  if  the  questions  were  clear  and  unbiased,  if 
the  terminology  used  to  describe  the  programs  was  precise,  and  whether 
the  survey  questionnaire  placed  an  undue  response  burden  on  companies. 
After  revising  the  survey  to  incorporate  pretest  comments  in  August  2008, 
we  sent  an  e-mail  to  all  57  contractors  in  early  September  2008  with 
instructions  for  accessing  the  survey  and  followed  up  with 


^  The  scope  of  our  review  limits  our  analysis  as  follows:  (1)  we  limited  this  review  to  57 
major  defense  contractors  and  thus  our  results  cannot  be  generalized  as  representing  all 
defense  contractors’  internal  ethics  programs  and  (2)  we  limited  our  review  to  self- 
reported  responses  and  corroborating  documentation  from  contractors  on  their  internal 
ethics  programs,  which  we  did  not  independently  verify  for  implementation  or  test  for 
effectiveness. 
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nonrespondents  by  e-mail  and  telephone  to  encourage  their  responses. 
After  we  closed  out  the  survey  on  October  24,  2008,  congressional 
committee  staff  requested  that  we  pursue  responses  from  the  remaining 
unresponsive  contractors,  and  we  contacted  the  contractors;  reopened  the 
survey  on  March  13,  2009,  for  5  business  days;  and  obtained  their 
responses. 

The  multisection  survey  was  designed  to  address  all  of  the  ethics  program 
elements  identified  in  Section  848  and  those  now  required  by  the  FAR,  as 
shown  in  table  lO’s  side-by-side  comparison.  The  survey  was  organized  in 
various  sections  to  obtain  contractors’  self-reported  information  on  their 
internal  ethics  programs  in  key  areas,  such  as  (1)  code  of  business  ethics 
and  conduct,  (2)  internal  and  external  mechanisms  for  reporting 
misconduct,  (3)  notification  to  contractor  employees  of  their  right  to  be 
free  from  reprisal  for  disclosing  a  substantial  violation  of  law,  (4)  ethics 
training  programs,  (5)  internal  audits,  and  (6)  appropriate  management 
oversight.  GAO’s  e-supplement,  GAO-09-646SP,  provides  the  questions 
used  for  the  survey  as  well  as  the  aggregated  responses.  We  analyzed 
responses  from  the  57  contractors  that  responded  to  the  survey — a  smvey 
response  rate  of  100  percent — in  comparison  to  the  FAR  requirements 
introduced  from  December  2007  through  December  2008.  In  addition  to 
analyzing  self-reported  information  from  the  survey  responses,  we 
requested  that  all  57  contractors  send  us  corroborating  documentation  to 
review  for  various  practices  in  their  internal  ethics  programs,  including 
practices  now  required  by  the  FAR,  such  as  management  oversight  and 
ethics  and  compliance  training.  We  did  not  verily  implementation  or  test 
the  effectiveness  of  contractor  ethics  program  practices  self-reported 
through  our  survey. 

We  selected  a  nongeneralizable  sample  of  4  of  the  57  contractors  for  site 
visits  in  order  to  review  in  detail  implementation  practices  for  some  of  the 
ethics  program  policies  or  procedures  described  in  their  siuvey  responses, 
such  as  disciplinary  actions,  hotline  calls,  and  ethics  training  programs. 
Our  selection  criteria  in  part  were  whether  (1)  the  contractors  were 
ranked  among  the  top  15  contractors  in  terms  of  dollar  value  of  DOD 
contracts  awarded  to  them  in  fiscal  year  2006  and  (2)  their  survey 
responses  indicated  that  the  contractors  had  such  policies  or  procedures 
in  use.  We  visited  Boeing  Company,  General  Dynamics,  Computer 
Sciences  Corporation  (CSC),  and  Science  Applications  International 
Corporation  (SAIC)  from  December  2008  through  February  2009  and 
obtained  detailed  information  from  senior  company  officials  responsible 
for  management  of  ethics  program-related  practices  described  in  their 
responses  to  om  survey. 
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To  determine  the  benefits  and  challenges  contractors  face  in  implementing 
the  new  FAR  requirements,  we  analyzed  contractor  views  from  our  Web- 
based  survey.  To  identify  views  and  perspectives  similar  to  or  different 
from  those  obtained  from  the  survey,  we  reviewed  responses  to  public 
comments  prepared  by  the  FAR  Council  and  published  in  the  Federal 
Register. 


Second  Audit  Objective  To  assess  the  impact  that  expanded  FAR  contractor  ethics  program 

requirements  have  on  DOD  monitoring  or  approval  of  defense  contractor 
ethics  programs,  we  focused  on  defense  and  military  organizations 
responsible  for  oversight  and  investigation  of  contractor  operations  and 
improper  business  practices:  (1)  Defense  Contract  Management  Agency 
(DCMA);  (2)  Defense  Contract  Audit  Agency  (DCAA);  (3)  DOD  IG;  (4)  the 
Air  Force,  Army,  and  Navy  offices  responsible  for  suspension  and 
debarment;  and  (5)  the  Office  of  the  Under  Secretary  of  Defense  for 
Acquisition,  Technology  and  Logistics  (AT&L).  We  interviewed  senior 
procurement  officials;  general  counsel;  and  contract  administration,  audit, 
and  investigative  service  officials  concerning  these  agencies’  roles  and 
responsibilities  for  monitoring  or  approving  contractor  ethics  programs. 
Through  interviews  and  information  obtained  from  these  officials,  we 
obtained  views  and  reviewed  supporting  documentation  concerning  the 
impact  the  new  FAR  rules  have  had  or  could  have  on  DOD  contractor 
oversight  activities  regarding  monitoring  contractors’  compliance  with 
ethics  program  practices  required  by  the  FAR  rules. 

In  addition,  we  communicated  with  selected  officials  from  the  DOD 
agencies  listed  above  to  obtain  updates  regarding  changes  in  their  policies 
and  procedures  to  implement  the  expanded  FAR  requirements,  reviewed 
available  guidance  and  instructions  these  agencies  developed  to 
implement  the  FAR  changes,  and  analyzed  public  comments  attributed  to 
DOD  or  other  government  sources  and  FAR  Council  responses  published 
in  the  Federal  Register  relevant  to  agencies’  implementation  of  the 
requirements.  We  also  interviewed  senior  DCAA  and  DCMA  officials 
colocated  at  four  contractor  field  office  locations  to  discuss  their  oversight 
of  contractor  ethics  programs  and  any  concerns  they  might  have  related  to 
those  programs  on  contractor  performance  and  costs.  We  did  not  test 
DOD  agencies’  effectiveness  in  implementing  their  contractor  ethics 
program  oversight  activities. 
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OFFICE  OF  THE  UNDER  SECRETARY  OF  DEFENSE 
3000  DEFENSE  PENTAGON 
WASHINGTON.  DC  20301-3000 


ACQUISITION, 
TECHNOLOGY 
AND  LOGISTICS 


SEP  1  6  2B09 


Mr.  John  K.  Needham 

Director,  Acquisition  and  Sourcing  Management 
U.S.  Government  Accountability  Office 
441  G  Street,  N.W. 

Washington,  DC  20548 

Dear  Mr.  Needham: 

This  is  the  Department  of  Defense  (DoD)  response  to  the  GAO  Draft  Report, 
GAO-09-591,  “DOD  CONTRACTING  INTEGRITY:  Opportunities  Exist  to 
Improve  DoD’s  Oversight  of  Contractor  Ethics  Programs,”  dated  August  21,  2009  (GAO 
Code  120736). 

The  Department  comments  on  the  report  recommendations  are  enclosed. 


Sincerely, 


Shay  D.  Assad 

Director^efense  Procurement 
and  Acquisition  Policy 


Enclosure: 
As  stated 
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GAO  DRAFT  REPORT  -  DATED  AUGUST  21,  2009 
GAO-09-59I  (GAO  CODE  120736) 

“DOD  CONTRACTING  INTEGRITY:  OPPORTUNITES  EXIST 
TO  IMPROVE  DOD’S  OVERSIGHT  OF  CONTRACTOR’S 
ETHICS  PROGRAMS” 

DEPARTMENT  OF  DEFENSE  COMMENT 
TO  THE  GAO  RECOMMENDATION 


RECOMMENDATION  1:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Acquisition,  Technology  and  Logistics)  to  determine 
what  if  any  new  Defense  Federal  Acquisition  Regulation  Supplement  (DFARS)  or  other 
guidance  is  needed  to  clarify  functional  responsibilities  of  Defense  Contract  Management 
Agency  (DCMA)  and  other  contracting  officials  during  contract  administration  for 
verifying  the  implementation  of  contractor  ethics  programs  as  required  under  the  Federal 
Acquisition  Regulation  (FAR)  ethics  rules. 

DOD  RESPONSE:  Concur.  The  recommendation  will  be  referred  to  the  Defense 
Acquisition  Regulation  Council  to  establish  a  DFARS  case  to  determine  whether 
additional  guidance  is  needed  to  clarify  the  functional  responsibilities  of  the 
administrative  contracting  officer. 

RECOMMENDATION  2:  The  GAO  recommends  that  the  DoD  Inspector  General 
(DoD  IG),  in  accordance  with  FAR,  determine  the  need  for  defense  contractors’  display 
of  the  IG’s  fraud  hotline  poster  to  include  directing  a  contractor  to  display  the  DoD  IG 
hotline  poster  in  common  work  areas  for  performance  of  DoD  contract. 

DOD  RESPONSE:  Concur. 

RECOMMENDATION  3:  The  GAO  recommends  that  the  DoD  IG,  in  accordance  with 
FAR,  determine  the  contents  of  the  IG’s  fraud  hotline  poster  for  display  by  defense 
contractors  to  include  revising  the  poster  to  inform  contractor  employees  of  their  federal 
whistleblower  protections. 

DOD  RESPONSE:  Concur. 

RECOMMENDATION  4:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Acquisition,  Technology  and  Logistics)  to  task  the  DoD 
Panel  on  Contracting  Integrity  draft  proposed  revisions  to  the  DFARS  to  include  policy 
requiring  a  contract  clause  directing  a  contractor  to  display  the  DoD  IG  hotline  poster  in 
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common  work  areas  for  performance  of  DoD  contracts.  DFARS  policy  should  require  a 
defense  contractor’s  display  of  the  DoD  IG  fraud  hotline  poster  irrespective  of  whether 
that  contractor  has  its  own  internal  mechanism  such  as  a  hotline  for  employees  to  report 
contract-related  improprieties. 

DOD  RESPONSE;  Partially  concur.  The  FAR  clause  52.203-14  already  requires  the 
contractor  to  prominently  display  the  DoD  Hotline  Poster  in  common  work  areas  within 
business  segments  performing  work  under  the  contract  and  at  contract  work  sites  with  the 
exception  noted  at  paragraph  (c).  The  issue  is  the  exception  noted  at  52.203-14(c)  which 
states  that  if  the  contractor  has  implemented  its  own  business  ethics  and  conduct 
awareness  program  including  a  reporting  mechanism,  the  agency  fraud  hotline  poster 
need  not  be  displayed.  DPAP  will  submit  the  proposed  revision  to  DFARS  in  a 
memorandum  to  the  Director,  DAR  Council,  identifying  this  GAO  recommendation.  It  is 
not  necessary  for  the  Panel  on  Contracting  Integrity  to  propose  revisions.  The  DFARS 
team  working  this  policy  area  will  consider  the  GAO  recommendations. 


Page  42 


GAO-09-59I  DOD  Contractor  Ethics  Programs 


Appendix  III:  Required  Federal  Acquisition 
Regulation  Components  for  Contractor 
Ethics  Programs 


The  final  FAR  rule — effective  in  December  2008 — reflects  contractor 
ethics  program  standards  across  four  broad  components,  as  shown  in 
table  12/  According  to  the  FAR  Council,  the  rule  establishes  a  framework 
for  institutional  ethics  management  and  disclosure  but  does  not  prescribe 
specific  ethical  requirements.  Contractors  are  free  to  establish  the 
appropriate  ethical  standards  for  their  businesses. 


Table  12:  Required  FAR  Components  for  Contractor  Ethics  Program  Practices 

Component  requirement 

Description 

Code  of  business  ethics  and 
conduct 

Required  for  businesses  with  contracts  or  subcontracts  over  $5  million  and  a  period  of  performance 
of  120  days  or  more;  must  be  implemented  within  30  days  of  contract  award;  must  be  written  and 
distributed  to  all  employees. 

Ethics  awareness  and 
compliance  program 

Required  for  noncommercial  item  acquisitions  and  businesses  that  are  other  than  "small"  and  with 
contracts  or  subcontracts  over  $5  million  and  a  period  of  performance  of  120  days  or  more;  must  be 
implemented  within  90  days  of  contract  award.  The  ongoing  program  shall  include  steps  to 
periodically  communicate  the  contractor's  business  ethics  standards  and  procedures  by  conducting 
training  programs  for  all  employees. 

Internal  control  system— Required  for  noncommercial  item  acquisitions  and  businesses  that  are  other  than  "small"  and  with 
contracts  or  subcontracts  over  $5  million  and  a  period  of  performance  of  120  days  or  more.  Among  others,  minimum  practices 
required  for  the  contractor's  internal  control  system  include  the  following. 

High  level  of  management 
oversight 

Assignment  of  high-level  responsibility  within  the  organization  and  adequate  resources  for  the  ethics 
and  compliance  program. 

Periodic  reviews,  audits,  or 
both 

Required  to  evaluate  effectiveness  of  company  business  practices,  procedures,  and  policies,  and 
internal  controls  for  compliance  with  the  established  code  of  business  ethics  and  conduct  and  the 
special  requirements  of  government  contracting. 

Internal  mechanism  for 
reporting  misconduct 

Mechanisms,  such  as  a  hotline,  for  employees  to  report  anonymously  or  confidentially  suspected 
instances  of  improper  conduct  and  instructions  that  encourage  employees  to  make  such  reports. 
Unless  the  contract  is  performed  entirely  outside  the  United  States  or  is  for  commercial  items,  a 
contract  clause  may  also  be  used  to  require  display  of  agency  fraud  hotline  posters,  but  the 
contractor  need  not  do  so  if  it  has  implemented  an  ethics  program  with  an  internal  reporting 
mechanism,  such  as  a  hotline  poster  of  its  own. 

Disciplinary  systems 

Follow  through  with  disciplinary  action  for  improper  conduct  or  failing  to  take  reasonable  steps  to 
prevent  or  detect  improper  conduct;  exclude  an  individual  as  a  principal  who  has  engaged  in  conduct 
in  conflict  with  the  established  code  of  ethics. 

Timely  disclosure 

In  connection  with  the  award,  performance,  or  closeout  of  a  contract  or  subcontract,  mandatory 
reporting  of  credible  evidence  of  violations  of  (1)  federal  criminal  law  involving  fraud,  conflict  of 
interest,  bribery,  or  gratuity  violations  found  in  Title  18  of  the  U.S.  Code  or  (2)  the  civil  False  Claims 
Act.  For  contracts  or  subcontracts  over  $5  million  and  a  period  of  performance  of  120  days  or  more, 
as  required  by  contract  clause,  they  shall  timely  disclose  these  violations  of  federal  criminal  law  and 
the  civil  False  Claims  Act  in  writing  to  the  agency  Office  of  the  Inspector  General  with  a  copy  to  the 
contracting  officer. 

Sources:  FAR  Subpart  3.10,  clauses  52.203-13,  and  52.203-14  {information):  GAO  (analysis  and  presentation). 


^  73  Fed.  Reg.  67064-93  (Nov.  12,  2008). 
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GAO’S  Mission 

The  Government  Accountability  Office,  the  audit,  evaluation,  and 
investigative  arm  of  Congress,  exists  to  support  Congress  in  meeting  its 
constitutional  responsibilities  and  to  help  improve  the  performance  and 
accoimtability  of  the  federal  government  for  the  American  people.  GAO 
examines  the  use  of  public  funds;  evaluates  federal  programs  and  policies; 
and  provides  analyses,  recommendations,  and  other  assistance  to  help 
Congress  make  informed  oversight,  policy,  and  funding  decisions.  GAO’s 
commitment  to  good  government  is  reflected  in  its  core  values  of 
accountability,  integrity,  and  reliability. 

Obtaining  Copies  of 
GAO  Reports  and 
Testimony 

The  fastest  and  easiest  way  to  obtain  copies  of  GAO  documents  at  no  cost 
is  through  GAO’s  Web  site  (www.gao.gov).  Each  weekday  afternoon,  GAO 
posts  on  its  Web  site  newly  released  reports,  testimony,  and 
correspondence.  To  have  GAO  e-mail  you  a  list  of  newly  posted  products, 
go  to  www.gao.gov  and  select  “E-mail  Updates.” 

Order  by  Phone 

The  price  of  each  GAO  publication  reflects  GAO’s  actual  cost  of 
production  and  distribution  and  depends  on  the  number  of  pages  in  the 
publication  and  whether  the  publication  is  printed  in  color  or  black  and 
white.  Pricing  and  ordering  irrformation  is  posted  on  GAO’s  Web  site, 
http://www.gao.gov/ordering.htm. 

Place  orders  by  calling  (202)  512-6000,  toll  free  (866)  801-7077,  or 

TDD  (202)  512-2537. 

Orders  may  be  paid  for  using  American  Express,  Discover  Card, 

MasterCard,  Visa,  check,  or  money  order.  Call  for  additional  information. 

To  Report  Fraud, 
Waste,  and  Abuse  in 
Federal  Programs 

Contact: 

Web  site:  www.gao.gov/fraudnet/fraudnet.htm 

E-mail:  fraudnet@gao.gov 

Automated  answering  system:  (800)  424-5454  or  (202)  512-7470 

Congressional 

Relations 

Ralph  Dawn,  Managing  Director,  dawnr@gao.gov,  (202)  512-4400 

U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7125 
Washington,  DC  20548 

Public  Affairs 


Chuck  Young,  Managing  Director,  youngcl@gao.gov,  (202)  512-4800 
U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7149 
Washington,  DC  20548 
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